How to keep secure code of Electron when someone extract asar?

Question

I am building an offline electron js react js and express js application. but the issue is when I build the app and extract the asar file all the code gets exposed including express js.

How can I protect express js code. How others are building offline applications with electron js. I have been searching for the solution since a week.

I tried react only but ittt does not support direct connection to the database without the backend.

so is there any way to protect backend code from electron or express and how apps like vyapar, WhatsApp, slack manage this security. ???

Answer 1

I've faced this issue for some time now and the best solution I've found so far is to compile the code into bytecode (using bytenode). This would make it extremely hard for people to convert it into readable code.

You could also do some extra steps like:

• obfuscating the code before compiling
• protect the asar file from extraction using asarmor (simple protection and doesn't prevent extraction)