Disable editing of javascript from chrome console?

user1759942 picture user1759942 · Nov 1, 2012 · Viewed 8.8k times · Source

So, I just noticed today that you can apparently run javascript in the chrome console. I had no idea you could do this. It's actually really cool.

In my rails app, I have an external javascript page. Some of the variables on that page I would like to be global so that all the functions in the JS file can access them. for example I have a map, and I would like the map object to be global in the javascript file because that way all my functions access the one map variable instead of creating their own, and I can break complex operations down into smaller functions.

This is all well and good I know how to do that and it's working perfectly. My problem now, can I protect the variables from outside? For example you can change the values of all the javascript class variables from the chrome console.. as well methods from for example the map are accessible and excecutable.. I have locked the map settings on one of the pages so it is not zoomable or movable, however from the console I can simply say map.setZoom(11) and the map will zoom to 11.. I can type map.dragable = true and bam u can drag the map.. I don't like this really..

It's not too terribly bad yet like the user enabling map drag and zoom isnt the worst thing in the world.. but still I'd like to disable this. Any ideas?

EDIT

Thanks all for the answers and comments. I guess I will just resort to not putting anything that can be turned malicious into my javascript, and do thing like pass my map variable to functions where necessary to slow people down.

Answer

Blender picture Blender · Nov 1, 2012

You can use an immediately-invoked function (IIFE) expression to prevent your variables and functions from being exposed in the global scope:

var a = 10;

(function() {
    var b = 20;
})();

window.a lets you view and modify a, but you cannot do that with b:

enter image description here

Try it out here

I'm more than sure that there's a way to edit b with Inspector, but I haven't taken the time to figure it out. Don't waste your time trying to prevent your users from modifying code that they can view.