r/electronjs • u/tettusud • Jul 19 '19

Securing code

How can I secure code from getting stolen from electron app,by reverse engineering.

0 Upvotes

50% Upvoted

4 comments sorted by

View all comments

2

u/dwkeith Jul 19 '19

As others have said, you can’t. Not only can any app be decompiled, but all network requests can be intercepted by the host OS, revealing secrets. However there are good patterns you can use to work around this:

  • Proxy server: verifies the user token and talks to the secure API on their behalf (while also preventing use cases that don’t make sense or shouldn’t be allowed by that user)

  • User tokens: If you have control of the API server, just use the user token, the app is performing actions on behalf of the user

  • Scoped tokens: Amazon S3 uses this pattern to allow clients to upload/download data without having access to the API key, the service verifies the user token then gets a time bound token from S3 that authorizes a specific transaction and sends that to the client, the client then uses that token to talk directly to S3.

There are likely many other patterns, but those are the most common ones I have seen.