I'm creating a JS counter for an exams website, I found that they can add extra time very easily in console by running sec += 10000, how can I stop this.
I'm using laravel in the backend
runCounter();
function runCounter() {
let min = 45;
let sec = min * 60;
let x = setInterval(function() {
console.log(secFormat(sec))
sec -= 1;
if (sec <= 0) {
endExam();
clearInterval(x);
}
}, 1000);
}
function secFormat(x) {
x = Number(x);
let h = Math.floor(x / 3600);
let m = Math.floor(x % 3600 / 60);
let s = Math.floor(x % 3600 % 60);
m += h * 60;
if (m < 10) {
m = "0" + m
}
if (s < 10) {
s = "0" + s
}
return m + ":" + s;
}
function endExam() {
alert('exma ended');
}Simple: In your Laravel project you store the time when the user started the exam and you create a cron job that will periodically run and check whether any of the exams' time elapsed. If so, then handle that exam as failed, since the user failed to send in the answers in time.
You will not need to worry then about how the user may change the JS code, since if the server is aware of when the exam has started, then it's irrelevant what the student or the browser claims.
Your main issue is that your website assumes that the user's browser has accurate information. But the user will be able to change the JS code as they please.
You can make it more difficult to your users by wrapping a function around all your Javascript, like
function() {
//your JS code
}();
in which case at least your functions will not be in global context. But that can be hacked as well.
Let me explain why you cannot prevent this from happening by any means:
Even easier: The user can simply put a breakpoint somewhere in the Javascript code while he/she thinks about the solutions and then his/her time will never pass.
Never trust user data.
Put your function in self executing function as below
(function runCounter() {
let min = 45;
let sec = min * 60;
let x = setInterval(function() {
console.log(secFormat(sec))
sec -= 1;
if (sec <= 0) {
endExam();
clearInterval(x);
} }, 1000); }
)();
so its variables becomes private to external enviroment, i.e to console