XMPP Strophe.JS Application Security Concern

Question

I'm looking for a good XMPP Chat Application standard for web platform (like eBuddy, Facebook Chat, etc.) I've googled some XMPP libraries for web application and my choice goes to Strophe.js since it is very simple and robust.

But I'm not sure to developing a pure Javascript application because of security concern. Most of modern browser could see your Javascript code by inspect element feature like Google Chrome does. I'm afraid this could be a critical problem in future days. All people could see and know your application logic and what your application does behind the scene.

My question is it possible to combining Strophe.js and server-side programming (eg. PHP, ASP.NET, etc). I mean using Strophe.js as a View-Tier and server-side programming as Controller-Tier?

Or is it possible to hide your Javascript code, so that user could not see the details behind the scene of you application?

What is the best practice?

Thanks in advance :)

Answer 1

Depends on what your security concerns are.

My concern was the username and password public. Our web app is MVC and I built a class that creates/logs in the users and passes the SID, RID and JID back out to the front end (Strophe) to then attach to the jabber server to start chatting. See http://xmpp.org/extensions/xep-0206.html for more. Essentially create the xml strings, send to the jabber server and manage the responses as shown in xep 206.