Path: csiph.com!eternal-september.org!feeder.eternal-september.org!news.eternal-september.org!.POSTED!not-for-mail From: Ben Bacarisse Newsgroups: comp.lang.javascript Subject: Re: JavaScript code security Date: Wed, 24 May 2017 02:44:43 +0100 Organization: A noiseless patient Spider Lines: 39 Message-ID: <87poezuiyc.fsf@bsb.me.uk> References: <58a53166-53fb-4974-9264-d73f26a0a549@googlegroups.com> <9817aa91-22fd-4064-980c-c872fe530dd3@googlegroups.com> Mime-Version: 1.0 Content-Type: text/plain Injection-Info: mx02.eternal-september.org; posting-host="95aa184a244c61a799406b3927b6d4cb"; logging-data="22696"; mail-complaints-to="abuse@eternal-september.org"; posting-account="U2FsdGVkX19EGwbC1o89EGtWLJxKezVQL3vAlmMKnfw=" Cancel-Lock: sha1:7I/vCCJC2N2iKEEsoy4tRNYSLPc= sha1:YuXIju+p8z68hdEcNn12o9jPSYk= X-BSB-Auth: 1.2b2081b54bdc9fcfa270.20170524024443BST.87poezuiyc.fsf@bsb.me.uk Xref: csiph.com comp.lang.javascript:33381 justaguy writes: > On Tuesday, May 23, 2017 at 4:12:04 PM UTC-4, justaguy wrote: >> On Tuesday, May 23, 2017 at 4:02:08 PM UTC-4, justaguy wrote: >> > For a web app that is hosted on an AMAZON AWS server, I use >> > JavaScript to prevent duplicate data entry for a key field (a >> > question of "EXACT" match was asked here before), considering the >> > fact that the FORM would involve a large amount of data input I >> > didn't implement server side duplicate data validation but I have >> > code to detect if the user browser's JavaScript is disabled, if so, >> > I would alert the user and not display the data entry form. >> > However, just now I noticed that there are two duplicate records. >> > What could possibly caused this issue? One possibility is that the >> > AWS server has been compromised, thus, such duplicate data could be >> > generated via SQL statement. Another thing, about a week ago, one >> > of the key files were removed from this same server. >> > >> > What's your thought? >> > >> > Thanks. >> >> Is it possible that two individuals started to use the FORM at the >> same >time, thus, it would evade JavaScript code for duplicate record >> entry? > > And I wonder if a sophisticated hacker who's extremely knowledgeable > of JavaScript can break the JavaScript code of the page to bypass the > JS function to prevent duplicate data entry via one particular field. > Thoughts? Certainly. I'm not sure I'd call is sophisticated but, since it's programming, it's not the kind of thing that most web users could do. The bottom line is that client-side scripting can't do any serious validation. Use it to improve the user experience, not to protect your data integrity. -- Ben.