Been toying around with a basic browser-based game for a while now, and getting deep into the vulnerabilities of client-side script. I know enough to understand that no client-side script is ever safe. Ever. But I don't fully understand to what degree.

Using, say, Chrome's developer tools, I know I can set variables at will - even Object.freeze and Object.seal can be overcome. I also know I can put in breakpoints at key points and use the console to read variable values. Now, let's say I have a function checkStep() that fires each time the player moves on the grid. It sends a blank ajax request, and the server returns only a boolean to signify if a random battle has started or not. If a user is able to rewrite/disable this checkStep(), they can effectively eliminate random battles. Is there a way to redefine or disable functions from the console command line? If you were bent on preventing this function from firing, how would you do it? Could you even do it?

EDIT Clearly I worded this poorly. Going to accept the current answer and re-post.

  • 1
    \$\begingroup\$ Have you used any of the obfuscaters/compressors? This is not much different than being able to edit the compiled code of a native app. \$\endgroup\$ Nov 15, 2013 at 22:11
  • \$\begingroup\$ the user can always inject additional javascript or replace parts. there is really no way to make sure the client behaves. \$\endgroup\$
    – oberhamsi
    Nov 16, 2013 at 8:01
  • \$\begingroup\$ @oberhamsi thanks for the input - I'm aware that no client-side code is truly safe. My question is more along the lines of "is it just as easy to overwrite a function as it is to overwrite a variable?" \$\endgroup\$
    – CodeMoose
    Nov 18, 2013 at 14:03
  • \$\begingroup\$ I'd migrate this, but since your other question seems more in line with what you really wanted, and it's been migrated for you, I'll just close this. \$\endgroup\$
    – user1430
    Nov 18, 2013 at 15:44

1 Answer 1


You can modify any variable from the console. It's entirely possible to overwrite checkStep with a function that always returns false or does nothing. Even variables stored in closures can be modified, provided that you put a breakpoint in the right place.

The easiest way to prevent this is to use a minifier, but that's not going to stop people who decide to spend more than 5 minutes on trying to break the game. If you're worried about players exploiting the client vulnerabilities, you should implement an authoritative server. There's enough resources on the subject, so i don't see a point in delving deeper into it here.

  • \$\begingroup\$ Thanks for the answer dreta. My new mantra is "never trust the client", so I'm aware that I can't expect any javascript to be secure. I'd read conflicting articles - some stating that code can be directly overwritten, and some stating that code has to be ripped, modified and hosted externally in order to be overwritten. Just trying to get a feel for what kind of exploits take what level of dedication. \$\endgroup\$
    – CodeMoose
    Nov 18, 2013 at 14:02

Not the answer you're looking for? Browse other questions tagged .