Question

Is it possible to have a secure piece of Javascript code in a web application? By secure I mean that we can do things like query the server for permissions, and do operations that cannot be altered by the client?

Example:

    var flag = 0;

    $.ajax({
        async: false,
        url: "/check_permission_script.php",
        success: function(data){
            flag = parseInt(data);
        }
    });

    if (flag != 1){
        display_normal_content();
    }else{
        display_secure_content();
    }

Here I want to make a query to the server to check if the user has permission to see the secure content. If they have the permissions, then we use display_secure_content() to show them the secure content, if not, we use display_normal_content() to display normal content. The problem is, that via a debugging terminal, it is easy to set the flag variable == 1 on the client computer, or just call the display_secure_content() function directly.

My motivation for doing things this way is to have nice web app that uses ajax to get new content, without having to reload the page. I like this instead of having to reload the page.

So the question is, can we have JS scripts that are secure against client manipulation? Or is this simply impossible by the nature of the web infrastructure?

Thanks!!

Answer 1

Short answer, no – not with JavaScript alone. JavaScript executes on the client-side, so anything you put in it is accessible and by extension modifiable by the client.

Several tools exist to help with “security through obscurity” such as obfuscating the code, but this will not help you for your end goal.

What could help, given your current setup, is through Ajax you contact a server-side PHP page that handles all security/validation and returns what content to display. Doing this, the client-facing JavaScript only has the ability to “request”, not to validate or choose what to display.