Javascript: How to secure your code

Question

if you render your page with JS and need to implement a security feature, it comes down to something such as this:

var userID = getUserID();
if (userID == 1) {
   html += renderDeleteButton();
}

But won't the user be able to just open the debugger and change the value of userID ?

It’s more important that the function cannot be executed by unauthorized users. — Gumbo
– Gumbo, Commented Jul 28, 2012 at 7:46

Joe Malt · Accepted Answer · 2012-07-27 17:18:19Z

8

Yes they will. With JS, the user can do whatever the heck they want. This is why security stuff should go in your server-side code (PHP / ASP / etc.), as users cannot modify it.

answered Jul 27, 2012 at 17:18

Joe Malt

3971 silver badge16 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

running_randall · Accepted Answer · 2012-07-27 17:20:34Z

2

Do not trust anything from a client side script like JS. All client side scripts can be manipulated by the user. Any secure type of code should reside in a server side script.

answered Jul 27, 2012 at 17:20

running_randall

1262 bronze badges

Comments

jbabey · Accepted Answer · 2012-07-27 17:28:04Z

1

Validation/security checks in javascript are always only done to save the user the time of a trip to the server and back. They are strictly for performance only.

If you want actual security, it must be implemented on the server.

answered Jul 27, 2012 at 17:28

jbabey

46.8k12 gold badges73 silver badges94 bronze badges

Collectives™ on Stack Overflow

Javascript: How to secure your code

3 Answers 3

Comments

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related