0

I have a lightning component that checks if a field date has passed the current date.

The problem is that the current date is based on javascript new Date() object, so the user can change the date on his machine and 'hack' my date check.

This is my code:

// this is the date that I got from the record
var dueDate = new Date(record.Date_Scheduled__c);

// this is the date that I take from the system - this is the local machine's date that can be changed on the computer
var today = new Date();

// now I check if date has passed
if (today > dueDate) {
    // here I allow the user to do stuff because the due date has not passed
}
else {
    // here I disable the component because due date has passed
}

What I want is to take the date from the Salesforce server and not from the local machine.

QUESTION

Can I get the server's current date in the javascript controller without having an apex server call (like using $A or some other command)?

  • $A is aura, which is still a client-side framework, so even if that method exists it would return the browser time, and not the Org wide time/timezone, I would like to be wrong here though. – Pranay Jaiswal Nov 26 '18 at 10:28
  • @PranayJaiswal OK, but is there any other utility? – Itai Shmida Nov 26 '18 at 10:29
  • Your best bet is to pass the value from server since you need server value. – RedDevil Nov 26 '18 at 11:24
5

Anything you do client-side can be defeated by a sufficiently determined user. As noted by OWASP:

Be aware that any JavaScript input validation performed on the client can be bypassed by an attacker that disables JavaScript or uses a Web Proxy. Ensure that any input validation performed on the client is also performed on the server.

Also, more specifically, not only could they change their date, they could make local modifications to your script via GreaseMonkey or even the Developer Tools that are built-in to the browser. Even if you could get the server time, it wouldn't matter for your purposes, because it can be broken.

So, simply write the code that does the simple validation; if they defeat whatever you have in place, the server should catch the problem and return an error. For example, you might use force:recordData and put a validation rule on the object, or check the date in Apex code before committing changes to the database, etc.

  • Thanks @sfdcfox - you are right that my client code is always exposed, but you need to know really well your javascript to hack it. On the other hand, when the user sees a locked record because a field date overdue, it makes sense to try and change the date of the computer - no programming skills. This is why I am trying to avoid that problem. I will anyway adopt your suggestion to apply a validation rule - this is an excellent idea – Itai Shmida Nov 26 '18 at 13:31
  • @ItaiShmida Changing the computer clock will prevent SSL from working correctly. In fact, Google Chrome reports an error "your computer clock is ahead/behind" and refuse to connect to websites. Trying to subvert your logic with a simple a clock change might result in not being able to use the internet at all. – sfdcfox Nov 26 '18 at 16:27
  • I understand what you are saying, but in my testings, I change the computer date and all is well and I can 'hack' my development like that, I get no problems. The validation rule that I added did the trick and prevent from saving. – Itai Shmida Nov 27 '18 at 7:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.