I would like to know if people could modify an HTML 5 game's code to harm either the server or other players whom visit the page.

More specifically, whether someone could modify a simple game that doesn't have things like high-scores, global stats, log-in, etc. to harm other users and/or the server the game is hosted on.

Is this only a concern for games that retrieve data to be stored on the server itself?

  • \$\begingroup\$ As a general rule of thumb, assume players are packet-sniffing your network or rewriting the Javascript by default. Make your server enforces as many of the game rules and as much cheat detection as possible, and consider the Javascript side to be nothing more than a pretty means of translating the server communications into a visual representation of the gameplay. \$\endgroup\$
    – Pharap
    May 13, 2017 at 15:21

1 Answer 1


I would like to know if people could modify an HTML 5 game's code


Like all web technologies, the client has full access to the local code; they can browse the source, modify it and send unexpected data to the server, or sniff what the server is sending to the client, but not displayed.

to harm either the server

Yes. This is not specific to games, though, you could check for any web security resources and they would apply to games.

or other players whom visit the page.

Maybe. The least bad thing that could happen to them is that one malicious client is causing a DoS (denial of service) attack and prevents the other players from playing; the worst that could happen is that their private data is stolen. But again, this is not specific to games.

If the game code and content is downloaded from the server, and the player can play the game without needing to communicate with the server again, there is less worries to have. Your players will be able to cheat, but since they're in their own bubble, it's generally not a concern.

If you introduce the features that you have mentioned, then, yes, at that point, it starts to be a concern: cheating from players, players trying to hack the server to get more in-game currencies, get the other players information, etc.

  • 2
    \$\begingroup\$ Thanks for the clarification. I'll look into HTML 5/ Javascript/ web security best practices in general to get a better idea of ways to prevent potential breaches in security. \$\endgroup\$
    – Marianne
    May 13, 2017 at 2:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .