Block direct access to sources (Deprecate #237)

[t2ym]

Block direct access to sources (Deprecate #237)

Another approach to block access to sources via browser

• Service Worker to check request URLs
  • Block direct or view-source access to source codes without referrers
• For the entry URL (where hook.min.js has &service-worker-ready= parameter)
  • Introduce a ping service on the entry page so that Service Worker can check if the client is really a working app page or not
• Redirect to about:blank
  • Shut down the app on detection as viewing the sources is regarded as Dev Tools usage
• hook.parameters.appPathRoot = '/';
  • The app assets are under location.origin + hook.parameters.appPathRoot

Implementation

• hook.parameters.checkRequest = function (event, response) { /* check request */ return response ; }
• The ping service
  • Service Worker side:

  // disable-devtools.js
...
            let channel = new MessageChannel();
            let requestTimestamp = Date.now();
            channel.port1.addEventListener('message', (event) => {
              if (Array.isArray(event.data) && event.data[0] === 'ping' && event.data[1] === client.id) {
                let rtt = Date.now() - event.data[2];
                clientsLastResponses.set(client.id, rtt);
                let recentRequests = clientsRecentRequests.get(client.id);
                if (recentRequests) {
                  while (recentRequests.length > 0 && recentRequests[0] <= event.data[2]) {
                    recentRequests.shift();
                  }
                }
              }
            });
            channel.port1.start();
            // only the first parameter "ping" is mandatory
            client.postMessage([ 'ping', client.id, requestTimestamp ], [ channel.port2 ]);
...

• The entry page side (automatically starts on load)

  function startPingService() {
    console.log('service-worker.js: startPingService');
    navigator.serviceWorker.addEventListener('message', function (event) {
      let port = event.ports[0];
      let data = event.data;
      //console.log('startPingService: received ', JSON.stringify(data));
      if (port && Array.isArray(data) && data[0] === 'ping') {
        //console.log('startPingService: postMessage ', JSON.stringify(data));
        port.postMessage(data);
      }
    });
  }