0
\$\begingroup\$

Been toying around with a basic browser-based game for a while now, and getting deep into the vulnerabilities of client-side script. I know enough to understand that no client-side script is ever safe. Ever. But I don't fully understand to what degree.

Using, say, Chrome's developer tools, I know I can set variables at will - even Object.freeze and Object.seal can be overcome. I also know I can put in breakpoints at key points and use the console to read variable values. Now, let's say I have a function checkStep() that fires each time the player moves on the grid. It sends a blank ajax request, and the server returns only a boolean to signify if a random battle has started or not. If a user is able to rewrite/disable this checkStep(), they can effectively eliminate random battles. Is there a way to redefine or disable functions from the console command line? If you were bent on preventing this function from firing, how would you do it? Could you even do it?


EDIT Clearly I worded this poorly. Going to accept the current answer and re-post.

\$\endgroup\$

closed as off-topic by Josh Nov 18 '13 at 15:44

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Programming questions that aren't specific to game development are off-topic here, but can be asked on Stack Overflow. A good rule of thumb is to ask yourself "would a professional game developer give me a better/different/more specific answer to this question than other programmers?"" – Josh
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    \$\begingroup\$ Have you used any of the obfuscaters/compressors? This is not much different than being able to edit the compiled code of a native app. \$\endgroup\$ – Sean Middleditch Nov 15 '13 at 22:11
  • \$\begingroup\$ the user can always inject additional javascript or replace parts. there is really no way to make sure the client behaves. \$\endgroup\$ – oberhamsi Nov 16 '13 at 8:01
  • \$\begingroup\$ @oberhamsi thanks for the input - I'm aware that no client-side code is truly safe. My question is more along the lines of "is it just as easy to overwrite a function as it is to overwrite a variable?" \$\endgroup\$ – CodeMoose Nov 18 '13 at 14:03
  • \$\begingroup\$ I'd migrate this, but since your other question seems more in line with what you really wanted, and it's been migrated for you, I'll just close this. \$\endgroup\$ – Josh Nov 18 '13 at 15:44
1
\$\begingroup\$

You can modify any variable from the console. It's entirely possible to overwrite checkStep with a function that always returns false or does nothing. Even variables stored in closures can be modified, provided that you put a breakpoint in the right place.

The easiest way to prevent this is to use a minifier, but that's not going to stop people who decide to spend more than 5 minutes on trying to break the game. If you're worried about players exploiting the client vulnerabilities, you should implement an authoritative server. There's enough resources on the subject, so i don't see a point in delving deeper into it here.

\$\endgroup\$
  • \$\begingroup\$ Thanks for the answer dreta. My new mantra is "never trust the client", so I'm aware that I can't expect any javascript to be secure. I'd read conflicting articles - some stating that code can be directly overwritten, and some stating that code has to be ripped, modified and hosted externally in order to be overwritten. Just trying to get a feel for what kind of exploits take what level of dedication. \$\endgroup\$ – CodeMoose Nov 18 '13 at 14:02

Not the answer you're looking for? Browse other questions tagged or ask your own question.