Mini Program to prevent criminals from cracking

recently, the company developed a Mini Program, but within a few days of being online, the encryption method was cracked, and the signature key was taken away by others. They have been visiting the server all the time, excluding the artificial disclosure of the signature key. The only possibility is that Mini Program was decrypted by peers, got the Mini Program source code, simulated it with the installation of mobile phone root, got the compression package of Mini Program apk, and tried to crack it. Unexpectedly successful, Mini Program"s security mechanism is so fragile, so I would like to ask, is there any way to interfere with the code, so that even if others get the source code, they cannot decrypt it?

May.04,2022

do not put the private key at the front end

< hr >

what I understand now is that users can only access your interface within Mini Program, so why not use Wechat's official login verification but reinvent a verification scheme that is not at all secure?
as shown in the figure above, you can verify the custom login state and set the appropriate expiration time of the login state (if the user logs in to Mini Program, the login status will be re-obtained), and verify the login status when calling the API


signing key Why should I put it on the front end?


develop Mini Program with wepy . Besides, it's no use for others to get your front-end code, just like Wechat, it's easy to get a ui that is the same as Wechat, can I copy the functions of Wechat? The core is the background program, you can not prevent others from getting your front-end code, at best, compress and confuse the code.

Menu