25

This Enable Debug Mode for Lightning Components documentation says:

By default, the Lightning Component framework runs in production mode. This mode is optimized for performance. It uses the Google Closure Compiler to optimize and minimize the size of the JavaScript code. The method names and code are heavily obfuscated.

I've just installed one of our managed packages that now includes Lightning Components in a customer's sandbox. While the Developer Console presents "(hidden)" in place of the managed package component XML or JavaScript, using e.g. Chrome's "Developer Tools" it is easy to locate a single JavaScript file per component that contains the component JavaScript (minus the comments) and probably the other component artefacts in JSON encoded form. No obfuscation is applied (irrespective of the debug mode setting).

Apex code in managed packages is not visible in the org a managed package is installed into. This is a good thing to keep the software a "black box", hiding ugly code and ensuring the source can't be copied. So I'm surprised (given that the platform includes tooling that can obfuscate) that my code is not being obfuscated.

Any indication of if/when obfuscation of managed package Lightning Components will happen?

  • 4
    Lightning component Helper and Controller consists of Javascript code .Technically you cannot make it hidden completely .At best they can minify it and feel its a bug currently that needs addressing . – Mohith Shrivastava May 7 '17 at 5:23
  • 1
    Whereas Apex hides my ugly code (or intellectual property), I agree with Mohith that Salesforce needs to address how they will protect my investment in the packaged application I am delivering in Lightning. Obfuscation will not really solve this problem. – Christian Szandor Knapp May 7 '17 at 8:27
  • 1
    @ChristianSzandorKnapp What is possible is limited by what browsers can do so AFAIK obfuscation is the best that can be done. – Keith C May 7 '17 at 10:43
  • Agreed. Personally I don't mind but I'm getting the question a lot during dev groups. I wonder if the code is maybe obfuscated in production org with debug disabled/secure cache enabled. Haven't tried that yet – Christian Szandor Knapp May 7 '17 at 11:34
  • 1
    Wouldn't worry to much about it, if your code's really good salesforce will come out with a competing product anyway ;) – Scott Morrison Jun 16 '17 at 20:38
5

I believe in the next release we will minify and mangle the content of managed packages so it will make the reverse engineering very difficult.

Not sure if we will do it by default, or it will be an option, given that it will also limit the debugability from a developer point of view.

I will try confirm and post the final answer.

  • Thanks Diego, will be re-assuring to know what the plan is. – Keith C Aug 18 '17 at 7:13
  • @Diego - Do you have any update with this? Currently all code within a managed package as it relates to Lightning is visible to clients – Eric Sep 11 '17 at 19:28
  • Sorry for the delayed answer, I spoke to the PM. It is on the roadmap, but not sure when will be GA. Probably within the next couple of releases. – Diego Nov 14 '17 at 1:35
  • I have a hard time believing there is a reliable way to achieve this, by definition. I would love to see the details of this before false sense of security is released to the wild. – dzh Feb 21 '18 at 1:31
  • @dzh Basically we will deliver code minification and potentially some obfuscation prior. But at the end of the day is JS code, anyone bored enough can reverse engineer the code, as of for any web property in the world. – Diego Feb 22 '18 at 2:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.