JavaScript security: access objects within (function(){})

Question

Even though, I am not a JS newbie, I still have never used (function() {}) before as there was no need. But now I am concerned with security on userside level for my JS game to avoid cheating. So what I did is I placed the following code in my js file:

(function() {
    'use strict';
    
    let a = 1;
});

I tried to access the a variable from console and I couldn't. So I wanted to know - will users be able to access those variables and change them if I use this kind of structure?

Any client-side code is available to the user. There is no inherent security with client-side code. — Scott Marcus
– Scott Marcus, Commented Aug 17, 2022 at 17:49
A user doesn’t even need to run your code. They could just write their own client and just send some bogus data to your server… — deceze
– deceze ♦, Commented Aug 18, 2022 at 6:16

WillD · Accepted Answer · 2022-08-17 18:03:06Z

3

There is nothing you can to do completely secure that variable. Users will still be able to access it using the debugger, local overrides, or probably other means as well.

A value like that which you need to be immutable to a skilled browser user needs to be stored on a secured backend (server, api, or something).

For example see: Is there a way to change variable values while debugging JavaScript?

edited Aug 17, 2022 at 18:03

answered Aug 17, 2022 at 17:48

WillD

6,8429 gold badges37 silver badges69 bronze badges

Sign up to request clarification or add additional context in comments.

4 Comments

Timur Gafforov Over a year ago

Yeah, they are all backed up on server side. But still, users will be able to change the scripts and do things like move camera away to see more than others, which is cheating. Well. Will have to register user actions and send myself canvas contents every now and then I guess :-)

Timur Gafforov Over a year ago

Just so I know, how can one access and change this variable?

WillD Over a year ago

They could "pause" execution of a certain JS file using the chrome dev tools debugger. Then modify the value and restart execution.

WillD Over a year ago

In the most extreme case you could imagine a user writing their own web browser from scratch and loading your app on it. This imaginary browser could expose a handy interface to modify every value of every variable at will and there is nothing stopping the user from creating this. This is an extreme example but the point is is that you don't have any control over how your front end code is handled once your server serves it to the user.

Collectives™ on Stack Overflow

JavaScript security: access objects within (function(){})

1 Answer 1

4 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

4 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related