WebAssembly Protection

Shield provides specialized protection for WebAssembly (WASM) applications, securing your code when it runs directly in the browser or other WASM environments.

Understanding WebAssembly Security Challenges

WebAssembly presents unique security challenges that differ from traditional .NET applications:

• WASM code runs on the client device and is accessible to users
• Traditional .NET protections may not be compatible with WASM
• The browser's sandbox imposes limitations on some protection techniques
• WebAssembly binary format differs significantly from .NET IL

Shield addresses these challenges with specialized protection techniques designed specifically for WebAssembly applications.

WebAssembly Protection Strategy

Shield employs a multi-layered approach to securing WebAssembly applications:

1. Pre-compilation Protection: Applies compatible protections before WASM compilation
2. WebAssembly Binary Protection: Applies specialized protections to the compiled WASM binary
3. Metadata Security: Protects metadata while maintaining WASM functionality
4. JavaScript Integration Security: Secures the bridge between JavaScript and WASM
5. Resource Protection: Encrypts and compresses embedded resources

Supported WebAssembly Scenarios

Shield provides protection for various WebAssembly scenarios:

• Blazor WebAssembly: Full protection for Blazor WASM applications
• Mono WASM: Protection for applications using Mono WebAssembly
• .NET WASM: Support for .NET 7+ direct WebAssembly
• Hybrid Applications: Protection for applications using WASM alongside other technologies

Key Protection Areas

Source-Level Protection

Shield applies transformations to your source code before WebAssembly compilation:

• Name obfuscation compatible with WASM runtime
• Control flow obfuscation with WASM-specific optimizations
• String and constant encryption with WASM-compatible decoding

Binary-Level Protection

For the compiled WebAssembly binary, Shield provides:

• WASM module structure obfuscation
• Export name obfuscation
• Custom section protection

JavaScript Interop Security

Shield secures the JavaScript interop layer:

• JavaScript API obfuscation
• Interop call protection
• Call signature verification

Getting Started with WebAssembly Protection

Shield integrates with your WebAssembly development workflow:

1. Install Shield in your WebAssembly project
2. Configure WebAssembly-specific protection settings
3. Build your application with Shield enabled

For specific WebAssembly scenarios, see:

• Browser Security Context - Understanding browser-imposed limitations
• Obfuscation Strategy - WebAssembly-specific obfuscation techniques

Recommended Configuration

Below is a recommended configuration for WebAssembly applications:

{
  "preset": "custom",
  "protections": {
    "rename": {
      "rename_public": false,
      "rename_arguments": true,
      "flatten_namespaces": true
    },
    "control_flow_advance": {
      "intensity": 6
    },
    "constants_encryption": {},
    "resources": {
      "compress": true,
      "encrypt": true
    }
  },
  "wasm": {
    "mode": "autodetect",
    "optimizeInterop": true,
    "protectBinary": true
  }
}

{
  "preset": "custom",
  "protections": {
    "rename": {
      "rename_public": false,
      "rename_arguments": true,
      "flatten_namespaces": true
    },
    "control_flow_advance": {
      "intensity": 6
    },
    "constants_encryption": {},
    "resources": {
      "compress": true,
      "encrypt": true
    }
  },
  "wasm": {
    "mode": "autodetect",
    "optimizeInterop": true,
    "protectBinary": true
  }
}

Testing Protected WebAssembly Applications

After applying Shield protection to your WebAssembly application:

1. Test in multiple browsers (Chrome, Firefox, Safari, Edge)
2. Verify all JavaScript interop functionality
3. Test startup performance and memory usage
4. Verify all application features work correctly

Compatibility Considerations

Shield's WebAssembly protection is compatible with:

• Blazor WebAssembly 3.2+
• .NET 6+ WebAssembly
• Mono WebAssembly
• All modern browsers (Chrome, Firefox, Safari, Edge)
• Progressive Web Apps (PWAs)
• Electron and WebView applications

Learn More

For more detailed information about protecting WebAssembly applications: