How to avoid tampering of javascript / HTML elements

Question

in my fiddle I have an example that should only allow a user to click submit by turning the submit button element disabled to false based on some calculated javascript.

  function enable(TVD) {
    if (TVD[TVD.length - 1] >= trueTVD - 5 && TVD[TVD.length - 1] <= trueTVD + 5) {
      //console.log(TVD[TVD.length - 1]);
      $('#submitButton').prop("disabled", false);
    } else {
      $('#submitButton').prop("disabled", true);
    }
  }

What has happened is that I have found that some users have managed to bypass this presumably by using something like dev tools.

I would like to design this such that my security cant be bypassed. How do I accomplish this goal or hide the javascript from dev tools?

I'm no expert, but I'd imagine that sort of protection would need to be implemented server-side. — freginold
– freginold, Commented Oct 10, 2017 at 20:10

user8652056 · Accepted Answer · 2017-10-10 20:10:19Z

5

Short answer: You can't

Long answer: Everyone can send anything to your server. The only way to securely filter and check the user input is therefore on the server side only

Sorry

answered Oct 10, 2017 at 20:10

user8652056

Sign up to request clarification or add additional context in comments.

Comments

Mouser · Accepted Answer · 2017-10-10 20:12:41Z

2

The best way is validate on the server. Never trust anything that comes from a client. It could be tampered with.
It's never completely possible to stop dev-tools from being loaded, however you can make it difficult by disabling the F12-button and contextmenus, but that's a road you don't want to walk on.
Use code that is minified, so it becomes much harder to read and comprehend and to tamper with using dev-tools or other sniffers.

summerized: use minified (obfuscated) code in combination with sanity checks on the client and on the server (preferable on the database too).

answered Oct 10, 2017 at 20:12

Mouser

13.3k3 gold badges31 silver badges54 bronze badges

2 Comments

Tyler Cowan Over a year ago

Good to know, Unfortunately a 3rd party (Amazon Turk) hosts the server where submit will be sent to so even if I ping my own server with info it wont stop someone from clicking submit.

Mouser Over a year ago

Still you can post these to your server and use a curl in php to get results.

jjjmnz · Accepted Answer · 2017-10-10 20:10:48Z

1

Afaik, you can't hide javascript code to users. See this.

A low level way of achieving obfuscation would be to have minified javascript files, as most users wouldn't bother tracing single letter named variables and such.

answered Oct 10, 2017 at 20:10

jjjmnz

491 silver badge6 bronze badges

1 Comment

Lyth Over a year ago

It's not all about javascript, you can manipulate DOM (e.g. enable a button) without looking into code.

Collectives™ on Stack Overflow

How to avoid tampering of javascript / HTML elements

3 Answers 3

Comments

2 Comments

1 Comment

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

Comments

2 Comments

1 Comment

Your Answer

Sign up or log in

Post as a guest

Linked

Related