制作安全的PhoneGap / Cordova应用程序（Android）

Question

I am developing a new app for android. I tested PhoneGap the last days and I think it is a very good platform to develop an app. I started developing and now I have some security concerns.

Online

All the JavaScript gets hosted on my server and the app needs them to start.

Offline

I have my JavaScript in the app and it just validates some files before startup.

I want that my app is working online and offline.

---

Problem

If the files are offline every user (with root) can edit the code. The user can remove for example the In-App Purchase and the file validation for the offline mode.

I searched through the internet and I need so say that I didn't found a good answer how to secure my app.

I hope here is somebody who can give me tips or ideas to make my app working online and offline with beeing secure. Thanks!

Answer 1

Probably there is no bulletproof solution to make hybrid apps secure, however you could obfuscate your code using tools like https://github.com/mishoo/UglifyJS . Although not safe from reverse engineering, uglification willl make more difficulty to modify the code.