How to avoid tampering of javascript / HTML elements

Question

in my fiddle I have an example that should only allow a user to click submit by turning the submit button element disabled to false based on some calculated javascript.

  function enable(TVD) {
    if (TVD[TVD.length - 1] >= trueTVD - 5 && TVD[TVD.length - 1] <= trueTVD + 5) {
      //console.log(TVD[TVD.length - 1]);
      $('#submitButton').prop("disabled", false);
    } else {
      $('#submitButton').prop("disabled", true);
    }
  }

What has happened is that I have found that some users have managed to bypass this presumably by using something like dev tools.

I would like to design this such that my security cant be bypassed. How do I accomplish this goal or hide the javascript from dev tools?

I'm no expert, but I'd imagine that sort of protection would need to be implemented server-side. — freginold, Oct 10 '17 at 20:10

score 5 · Answer 1 · answered Oct 10 '17 at 20:10

5

Short answer: You can't

Long answer: Everyone can send anything to your server. The only way to securely filter and check the user input is therefore on the server side only

Sorry

answered Oct 10 '17 at 20:10

Dieter Schmitt

471
2
8

score 2 · Accepted Answer · answered Oct 10 '17 at 20:12

2

The best way is validate on the server. Never trust anything that comes from a client. It could be tampered with.
It's never completely possible to stop dev-tools from being loaded, however you can make it difficult by disabling the F12-button and contextmenus, but that's a road you don't want to walk on.
Use code that is minified, so it becomes much harder to read and comprehend and to tamper with using dev-tools or other sniffers.

summerized: use minified (obfuscated) code in combination with sanity checks on the client and on the server (preferable on the database too).

answered Oct 10 '17 at 20:12

Mouser

13,132
3
28
54

Good to know, Unfortunately a 3rd party (Amazon Turk) hosts the server where submit will be sent to so even if I ping my own server with info it wont stop someone from clicking submit. – Tyler Cowan Oct 10 '17 at 21:23
Still you can post these to your server and use a curl in php to get results. – Mouser Oct 10 '17 at 22:00

score 1 · Answer 3 · answered Oct 10 '17 at 20:10

1

Afaik, you can't hide javascript code to users. See this.

A low level way of achieving obfuscation would be to have minified javascript files, as most users wouldn't bother tracing single letter named variables and such.

answered Oct 10 '17 at 20:10

jjjmnz

49
1
6

2

It's not all about javascript, you can manipulate DOM (e.g. enable a button) without looking into code. – Lyth Oct 10 '17 at 20:13

How to avoid tampering of javascript / HTML elements

3 Answers3

Linked