Securing client-side javascript

[davidr]

I have a question. Is javascript that is ran 100% on the client-side
and never does any postback/callback to the server hack proof? A user
can open the source code look at it, but is there a way for him to
change it so it does what it isn't supose to do. For example,
you use the javascript to disable/enable buttons on an .aspx page.
Would it be easy for someone to change the javascript to decide which
buttons get enabled/disabled? I know you can use validation on
textboxes to prevent <script></script> to get ran on the client side,
is there any other way though? This is new to me so I look forward to
people's opinions on security for javascript. Thanks,

David

 

[Scott M.]

Any client-side code (HTML/JavaScript) can be viewed, changed and saved
locally on the client. So yes, someone could bypass client-side validation
of data and attempt to submit incorrect data, for example. This is why (in
the case of validation), you should always do a second, server-side,
validation of the data before processing it.