Is it possible to access a function's local variable from outside that function?

Question

Let's say I have the following code:

(function () {
  var secret = "a very secret string";
})();

Is it possible for any other scripts running on the page to access the variable secret? I know the end-user can easily access this variable by opening up the JavaScript debugger, but this is ok. My concern is that this script will be running as a third-party script and I don't want to leak any of the user's session information to the page that embeds my script.

no, unless you expose it in some way.

epascarello
– epascarello

2016-01-25 14:00:44 +00:00
Commented Jan 25, 2016 at 14:00 — epascarello
– epascarello, Commented Jan 25, 2016 at 14:00

CodingGorilla · Accepted Answer · 2016-01-25 14:01:34Z

2

No, from within the javascript runtime that variable would be visible only to that function. But if you have something that is truly secret, you can never trust that the client won't be able to access it. Consider that some other script on that page could issue an XHR to re-download the .js file and parse it out that way (if it really wanted to).

answered Jan 25, 2016 at 14:01

CodingGorilla

19.9k4 gold badges48 silver badges65 bronze badges

Sign up to request clarification or add additional context in comments.

4 Comments

Max Over a year ago

Could they really XHR the script if I haven't set any CORS headers?

CodingGorilla Over a year ago

There are a lot of different things that you can try to do to protect it, but if the browser can download the script, then something else can too.

T.J. Crowder Over a year ago

@Max: You've said your script is being run as "third party" script on the page, which I take to mean that it's being loaded from a page that isn't in the same origin as your script. If so, then no, they couldn't, because the page's origin wouldn't match the origin of your .js file. If your script weren't being loaded cross-origin, then yes, they could, because it's the page's origin that matters.

Max Over a year ago

Thanks for the input. The script is being dynamically generated per-user by injecting the cookie values into the script, since the user's cookie values will not be available on the consuming sites. Thanks for the help!

Vyacheslav · Accepted Answer · 2016-01-25 14:02:37Z

0

No. no access. But if a user try to debug this code, he can achieve the value using a breakpoint

answered Jan 25, 2016 at 14:02

Vyacheslav

27.3k22 gold badges124 silver badges209 bronze badges

Collectives™ on Stack Overflow

Is it possible to access a function's local variable from outside that function?

2 Answers 2

4 Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

4 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related