如何防止 html/JavaScript 代码修改

How to prevent html/JavaScript code modification

提问by Maik

I would like to know if there is a way to prevent an html page with jQuery or javascript to be modified by the user to change its behavior.

我想知道是否有办法防止用户修改带有 jQ​​uery 或 javascript 的 html 页面以更改其行为。

A user can modify it using tools such as FireBug or the Google Chrome developer bar to hide or show divs, add event listeners to page elements and so on.

用户可以使用 FireBug 或 Google Chrome 开发人员栏等工具对其进行修改，以隐藏或显示 div，向页面元素添加事件侦听器等。

I've seen some web pages showing a blocking div when the page is loaded and a pop-up telling to answer some question. If you answer it, the div hides and you can see the page normally. But if you try to hide the blocking div using FireBug, the page reloads and there is no way to see the page correctly if you don't ansewer the question asked in the pop-up.

我已经看到一些网页在加载页面时显示阻塞的 div 和一个弹出窗口来回答一些问题。如果你回答它，div隐藏，你可以正常看到页面。但是，如果您尝试使用 FireBug 隐藏阻塞 div，页面会重新加载，并且如果您不回答弹出窗口中提出的问题，则无法正确查看页面。

I want to know how could I prevent user from doing such things.

我想知道如何防止用户做这样的事情。

Thanks a lot.

非常感谢。

回答by jAndy

It is not possible (which is a verygood thing).

这是不可能的（这是一件非常好的事情）。

回答by Nick Craver

To defeat the method described in the question:

要击败问题中描述的方法：

• You can use the keyboard shortcuts to the console/tools (Ctrl+Shift+Iin Chrome)
• You can use the resource/net panel to see the source
• You can see it at any other level, e.g. Fiddler
• You can use a bookmarklet for easier access

• 您可以使用控制台/工具的键盘快捷键（Chrome 中的Ctrl+ Shift+ I）
• 可以使用resource/net面板查看源码
• 您可以在任何其他级别看到它，例如 Fiddler
• 您可以使用书签来更轻松地访问

No, you can't prevent people seeing or modifying your source/script if they want to...the ones you most want to prevent are the most able to circumvent any deterrent(and that's allanything you do is, a deterrent, not a stop) you put in place.

不，你不能阻止人们看到或修改你的源代码/脚本，如果他们想......你最想阻止的人最有能力规避任何威慑（这就是你所做的一切，威慑，而不是一个停止）你放置到位。

回答by Alin Purcaru

The only way to do it (in my opinion) is not have the page content load until the user does your desired action. After he answers the question (or whatever) you send an AJAX request for the content (of course, as thejh said, you should also validate the answer on the server, preferably in the same request). So you load page header, banners and anything not critical, but the actual content (say an article on a blog) should not be loaded until the user does your action.

唯一的方法（在我看来）是在用户执行您想要的操作之前不加载页面内容。在他回答问题（或其他问题）后，您发送内容的 AJAX 请求（当然，正如 thejh 所说，您还应该在服务器上验证答案，最好在同一请求中）。因此，您加载页面标题、横幅和任何不重要的内容，但在用户执行您的操作之前不应加载实际内容（例如博客上的文章）。

Everything that a user's browser receives belongs to the user, so you can't enforce anything on that.

用户浏览器收到的所有内容都属于该用户，因此您无法对其进行任何强制执行。

回答by Dr.Molle

For sure you can't prevent anybody from doing what he wants to, but you can make changes more difficult.

当然，你不能阻止任何人做他想做的事，但你可以让改变变得更加困难。

Take a look at the DOMEvents, especially the Mutation-Events. Those give you the ability to see when something has changes(attributes, removed/inserted nodes, data in textnodes ...). For example you could build a function that watches some special attributes you would'nt have to get changed and reload the page, if this happens.

看看DOMEvents，尤其是 Mutation-Events。这些使您能够查看某些内容何时发生变化（属性、删除/插入的节点、文本节点中的数据......）。例如，您可以构建一个函数来监视某些特殊属性，如果发生这种情况，您无需更改和重新加载页面。

回答by Spudley

As others have already said, it isn't possible to control what the end user does with data you've sent them.

正如其他人已经说过的那样，无法控制最终用户对您发送给他们的数据的处理方式。

It may be possible to detect the consoleobject that Firebug and others use, but what can your site do with that information once you've got it? You can't disable firebug or prevent it from being used, or even know whether it has been used.

也许可以检测console到 Firebug 和其他人使用的对象，但是一旦您获得了这些信息，您的站点可以用它做什么？您无法禁用 firebug 或阻止它被使用，甚至无法知道它是否已被使用。

The bottom line is that once the web page and javscript code have been sent to the browser, it is out of your control.

最重要的是，一旦将网页和 javscript 代码发送到浏览器，它就不受您的控制。

The closest you can get to what you want is to move some of your code out of Javascript and to the server, where it will be untouchable by the user. However you'll still have to have some client-side code, which will still be at the mercy of malicious users.

最接近您想要的东西是将您的一些代码从 Javascript 中移出到服务器，在那里用户将无法访问它。但是，您仍然必须拥有一些客户端代码，这些代码仍将受到恶意用户的支配。

The other alternative is to move to Flash or something similar, where the end user doesn't have direct access to the code or the object model. This has it's own downsides though, and you'd be bucking the trend, which is to move away from Flash toward HTML5 and Javascript.

另一种选择是转移到 Flash 或类似的东西，最终用户无法直接访问代码或对象模型。不过，这有其自身的缺点，而且您会逆势而上，即从 Flash 转向 HTML5 和 Javascript。

回答by thejh

It's impossible. When you send code to the client, the client can look at it and modify it. Only code that runs on your server is protected aganist that.

不可能。当您向客户端发送代码时，客户端可以查看并修改它。只有在您的服务器上运行的代码才受到保护。

回答by Arief

I don't think it's possible to do that unless you can make sure (or force) users to use browsers that don't have developer tool.

我认为这是不可能的，除非您可以确保（或强制）用户使用没有开发人员工具的浏览器。

回答by SSpoke

Use ajax to get remote information don't send the user all the information such as answers to polls etc get the answer after he picked a choice from the server using ajax for example. Client-side validation is never a good thing hell thats how I used to delete other stupid people's databases due to that unless people learn properly how things REALLY work they should get taught the hard way such as losing everything in a case of root access vulnerability.

使用 ajax 获取远程信息不要向用户发送所有信息，例如民意调查的答案等，例如在他使用 ajax 从服务器中选择一个选项后得到答案。客户端验证从来都不是一件好事，这就是我过去常常删除其他愚蠢人的数据库的方式，因为除非人们正确地了解事情的真正运作方式，否则他们应该接受艰难的教育，例如在 root 访问漏洞的情况下丢失所有内容。

I don't know why HTML has to be blocked it wasn't blocked since browsers came out he'll I could make my own browser with a socket and get HTML transfered right to some textbox and see it in my favorite notepad/editor etc..

我不知道为什么 HTML 必须被阻止它没有被阻止，因为浏览器出现了他会我可以使用套接字制作我自己的浏览器并将 HTML 直接传输到某个文本框并在我最喜欢的记事本/编辑器等中查看它..

As for javascript you can simply send javascript commands in browser address bar (how convenient of browsers in supporting hackers hehe but it's also used for inter-op communication with other technologies such as flash so it has a evil/good side to it as everything.)

至于 javascript，你可以简单地在浏览器地址栏中发送 javascript 命令（浏览器在支持黑客方面有多方便，呵呵，但它也用于与其他技术（如 flash）的互操作通信，因此它具有邪恶/善良的一面。 )

If you didn't know you can just do

如果你不知道你可以做

javascript: alert('hi');

or if your javascript game or whatever has globally scoped variables you can modify em easily

或者如果您的 javascript 游戏或任何具有全局范围的变量，您可以轻松修改它们

javascript: score=9999;damage=99999;

etc etc like i said it's all good it weeds out the bad programmers and gets em fired or teaches em a lesson in the future.

等等等等，就像我说的那样，这一切都很好，它淘汰了糟糕的程序员，让他们被解雇或在未来教他们一个教训。

I've seen many big sites still fall to a SIMPLE XSS attack (Cross-site scripting) which is just baffling how these programmers get a job, I'd do a better interview or some shit it's ridiculous

我见过许多大网站仍然陷入简单的 XSS 攻击（跨站点脚本），这让这些程序员如何找到工作感到困惑，我会做一个更好的面试或一些狗屎，这很荒谬