Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.javascript > #33381

Re: JavaScript code security

Show key headers only | View raw

justaguy <lichunshen84@gmail.com> writes:

> On Tuesday, May 23, 2017 at 4:12:04 PM UTC-4, justaguy wrote:
>> On Tuesday, May 23, 2017 at 4:02:08 PM UTC-4, justaguy wrote:
>> > For a web app that is hosted on an AMAZON AWS server, I use
>> > JavaScript to prevent duplicate data entry for a key field (a
>> > question of "EXACT" match was asked here before), considering the
>> > fact that the FORM would involve a large amount of data input I
>> > didn't implement server side duplicate data validation but I have
>> > code to detect if the user browser's JavaScript is disabled, if so,
>> > I would alert the user and not display the data entry form.
>> > However, just now I noticed that there are two duplicate records.
>> > What could possibly caused this issue?  One possibility is that the
>> > AWS server has been compromised, thus, such duplicate data could be
>> > generated via SQL statement.  Another thing, about a week ago, one
>> > of the key files were removed from this same server.
>> > 
>> > What's your thought?
>> > 
>> > Thanks.
>> 
>> Is it possible that two individuals started to use the FORM at the
>> same >time, thus, it would evade JavaScript code for duplicate record
>> entry?
>
> And I wonder if a sophisticated hacker who's extremely knowledgeable
> of JavaScript can break the JavaScript code of the page to bypass the
> JS function to prevent duplicate data entry via one particular field.
> Thoughts?

Certainly.  I'm not sure I'd call is sophisticated but, since it's
programming, it's not the kind of thing that most web users could do.

The bottom line is that client-side scripting can't do any serious
validation.  Use it to improve the user experience, not to protect your
data integrity.

-- 
Ben.

Back to comp.lang.javascript | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

JavaScript code security justaguy <lichunshen84@gmail.com> - 2017-05-23 13:02 -0700
  Re: JavaScript code security justaguy <lichunshen84@gmail.com> - 2017-05-23 13:11 -0700
    Re: JavaScript code security justaguy <lichunshen84@gmail.com> - 2017-05-23 17:56 -0700
      Re: JavaScript code security Ben Bacarisse <ben.usenet@bsb.me.uk> - 2017-05-24 02:44 +0100
        Re: JavaScript code security justaguy <lichunshen84@gmail.com> - 2017-05-23 19:06 -0700
          Re: JavaScript code security "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2017-05-24 09:11 +0200
            Re: JavaScript code security justaguy <lichunshen84@gmail.com> - 2017-05-24 05:56 -0700
              Re: JavaScript code security Wally W. <ww84wa@aim.com> - 2017-05-29 14:57 -0400
                Re: JavaScript code security "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2017-05-30 09:41 +0200
                Re: JavaScript code security Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2017-06-23 10:53 +0200
                Re: JavaScript code security "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2017-06-23 13:38 +0200
            Re: JavaScript code security Ben Bacarisse <ben.usenet@bsb.me.uk> - 2017-05-24 14:28 +0100
              Re: JavaScript code security "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2017-05-24 18:07 +0200
        Re: JavaScript code security justaguy <lichunshen84@gmail.com> - 2017-05-24 06:01 -0700
          Re: JavaScript code security John G Harris <niam@jghnorth.org.uk.invalid> - 2017-05-24 14:19 +0100
            Re: JavaScript code security justaguy <lichunshen84@gmail.com> - 2017-05-24 10:01 -0700
              Re: JavaScript code security "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2017-05-24 19:18 +0200
                Re: JavaScript code security justaguy <lichunshen84@gmail.com> - 2017-05-24 11:39 -0700
                Re: JavaScript code security "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2017-05-24 23:07 +0200
                Re: JavaScript code security justaguy <lichunshen84@gmail.com> - 2017-05-24 14:26 -0700
                Re: JavaScript code security "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2017-05-25 16:26 +0200
  Re: JavaScript code security Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2017-05-24 01:12 +0200
    Re: JavaScript code security justaguy <lichunshen84@gmail.com> - 2017-05-23 17:15 -0700
      Re: JavaScript code security Stefan Weiss <krewecherl@gmail.com> - 2017-05-24 04:14 +0200
        Re: JavaScript code security justaguy <lichunshen84@gmail.com> - 2017-05-23 19:47 -0700
  Re: JavaScript code security Myers <xdaamanx@gmail.com> - 2017-05-29 07:54 -0700
  Re: JavaScript code security Myers <xdaamanx@gmail.com> - 2017-05-29 07:55 -0700

csiph-web