25

This Enable Debug Mode for Lightning Components documentation says:

By default, the Lightning Component framework runs in production mode. This mode is optimized for performance. It uses the Google Closure Compiler to optimize and minimize the size of the JavaScript code. The method names and code are heavily obfuscated.

I've just installed one of our managed packages that now includes Lightning Components in a customer's sandbox. While the Developer Console presents "(hidden)" in place of the managed package component XML or JavaScript, using e.g. Chrome's "Developer Tools" it is easy to locate a single JavaScript file per component that contains the component JavaScript (minus the comments) and probably the other component artefacts in JSON encoded form. No obfuscation is applied (irrespective of the debug mode setting).

Apex code in managed packages is not visible in the org a managed package is installed into. This is a good thing to keep the software a "black box", hiding ugly code and ensuring the source can't be copied. So I'm surprised (given that the platform includes tooling that can obfuscate) that my code is not being obfuscated.

Any indication of if/when obfuscation of managed package Lightning Components will happen?

7
  • 4
    Lightning component Helper and Controller consists of Javascript code .Technically you cannot make it hidden completely .At best they can minify it and feel its a bug currently that needs addressing . Commented May 7, 2017 at 5:23
  • 1
    Whereas Apex hides my ugly code (or intellectual property), I agree with Mohith that Salesforce needs to address how they will protect my investment in the packaged application I am delivering in Lightning. Obfuscation will not really solve this problem. Commented May 7, 2017 at 8:27
  • 1
    @ChristianSzandorKnapp What is possible is limited by what browsers can do so AFAIK obfuscation is the best that can be done.
    – Keith C
    Commented May 7, 2017 at 10:43
  • Agreed. Personally I don't mind but I'm getting the question a lot during dev groups. I wonder if the code is maybe obfuscated in production org with debug disabled/secure cache enabled. Haven't tried that yet Commented May 7, 2017 at 11:34
  • 1
    Wouldn't worry to much about it, if your code's really good salesforce will come out with a competing product anyway ;) Commented Jun 16, 2017 at 20:38

1 Answer 1

5

I believe in the next release we will minify and mangle the content of managed packages so it will make the reverse engineering very difficult.

Not sure if we will do it by default, or it will be an option, given that it will also limit the debugability from a developer point of view.

I will try confirm and post the final answer.

5
  • Thanks Diego, will be re-assuring to know what the plan is.
    – Keith C
    Commented Aug 18, 2017 at 7:13
  • @Diego - Do you have any update with this? Currently all code within a managed package as it relates to Lightning is visible to clients
    – Eric
    Commented Sep 11, 2017 at 19:28
  • Sorry for the delayed answer, I spoke to the PM. It is on the roadmap, but not sure when will be GA. Probably within the next couple of releases.
    – Diego
    Commented Nov 14, 2017 at 1:35
  • I have a hard time believing there is a reliable way to achieve this, by definition. I would love to see the details of this before false sense of security is released to the wild.
    – dzh
    Commented Feb 21, 2018 at 1:31
  • @dzh Basically we will deliver code minification and potentially some obfuscation prior. But at the end of the day is JS code, anyone bored enough can reverse engineer the code, as of for any web property in the world.
    – Diego
    Commented Feb 22, 2018 at 2:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .