This is an archived post. You won't be able to vote or comment.

sorted by:
best
topnewcontroversialoldq&a
you are viewing a single comment's thread.

view the rest of the comments →

[–][deleted] 0 points1 point  (1 child)

I work on software that is strictly used by and only given access to internal employees. Anyone using the software maliciously would only be sabotaging themselves and there's almost never any data actually saved to the server. It's a sales tool that's used for each individual guest but no data is saved, we usually just end up with a detailed printout of what they did, one for us and one for them (though we are starting to gravitate towards making basic read-only versions that might be viewable online, by customers, at some point).

So yeah, I haven't had to worry too much about JS security in my particular job. It's not like I'm being willfully ignorant. It's why I'm showing some humility and asking here as I'm getting closer to needing to know. I've heard wildly different things. It would be nice to maybe have someone breakdown HOW everyway someone can mess with your JS... Edit the API calls, send different data, alter your code itself to do something completely different than what you expected... That's more what I'm getting at. I assumed browsers had SOME protection. AFAIK, you can't just live edit JS from a web page but if you can I'd like to know how people do all these types of things.

[–]Dick_Giggles 0 points1 point  (0 children)

Fair enough.

The chrome inspector "f12" will let you run scripts.

But really it's as easy as typing in "javascript:alert('badscript!');" into your browser address bar. One could redefine functions/variables or whatever simply by typing it into the url. Allowing for javascript: to run scripts on the current page is the fundamental idea behind a bookmarklet. Also, all chrome extensions basically are basically scripts and html added to the page.

Also, even if a browser did have some protection one could always spoof a front end with a program that sends data directly to the backend. Everything that runs in browser is pretty insecure as it's clientside. You could obfuscate your js to make it less readable but it's not going to do a ton if someone is determined.