Question

I have implemented an object as a closure in JavaScript, some of the methods are public, some other are private:

var MyObject = (function(){

    function _hiddenMethod() {
        /* Do something fancy here, such as reading data 
        from an external source and storing it in 
        _hiddenVariable2 */
    } 

    var _hiddenVariable1 = 3;
    var _hiddenVariable2 = undefined;

    return {
        publicMethod: function() {
            _hiddenMethod();
            return _hiddenVariable1;
        };
    };

})();

Is there a way in which a (skilled) user could possibly read the content of _hiddenVariable2? I assume it knows its existence by having read the JavaScript code.

Answer 1

There is no way I know of but it might depend on the javascript engine.

Also keep in mind, that anyone can debug javascript and note whenever _hiddenVariable2 is set in the closure (write something like _hiddenVariable2 = 5 inside the _hiddenMethod, try developer tools for chrome and insert a breakpoint into the _hiddenMethod, and you will be able to see when _hiddenVariable2 is set).

So a skilled user can know the current value of it if hes debugging the code in V8 for example.