PHP加密-JS解密。 安全问题

Question

i have a bunch of websites of mine that need to call an external server asking for some data. This server contains sensible information such as discount codes that need to be applied on the website, based on what the user is doing.

Since i can't do a synchronous ajax call on users' actions (deprecated and bad practice), i'm doing it async everytime a user loads the page on these websites. The call retrieves all the possible discount codes but i'd like people not being able to decode it and get them for free. The server creates a json array and encodes it as base64, then the JS in the user browser will decode it (atob() function) giving me the json i needed to work with.

I'd like to apply an encryption to this like an algorithm for letters swapping or something. This means that even if the user reads my json result is not going to be able to read it BUT he could read it when my JS code tries to decode it (pausing with the debugger).

So my question is: could javascript obfuscation solve my issue? My JS would contain the algorithm to take my string back to its original form but the whole code is obfuscated therefore debugger won't work. Is that a safe approach to the matter? If not, how could i do it safely?

Summing it up, the system works like this:

1.User loads page in website

2.JSONP AJAX call asks all the available discount codes from my server

3.Server gets the list, makes a JSON of it and returns a base64 string of this json

4.Client gets this and when he clicks on something particular i decode the json and apply the correct discount based on calculations.

I hope it's clear enough for you to give some suggestions :)

thanks!

Answer 1

If you make your decryption on the Client machine, then there is no way of making it secure. You could apply obfuscation, or other means of hiding your process, but ultimately there is a point in the code which makes the decryption, and is available to the client. You should not do that on the client side.

You could maybe do this:

1. Website loads
2. It sends request for promo codes, along with the user details.
3. You send only data that is available for that user.

In this way you do not need to encrypt anything, but it will involve some rethinking and change to server side logic.

There is maybe another solution, which is hacky, and also requires server change. Send the codes as you already send them, but send them incomplete. Maybe remove last 2 or more digits. Then the user requests to activate promotion, and sends the incomplete code. Then you look in your table code that starts (like '%'), and create the working code on the server side.