0

I have a lightning component that checks if a field date has passed the current date.

The problem is that the current date is based on javascript new Date() object, so the user can change the date on his machine and 'hack' my date check.

This is my code:

// this is the date that I got from the record
var dueDate = new Date(record.Date_Scheduled__c);

// this is the date that I take from the system - this is the local machine's date that can be changed on the computer
var today = new Date();

// now I check if date has passed
if (today > dueDate) {
    // here I allow the user to do stuff because the due date has not passed
}
else {
    // here I disable the component because due date has passed
}

What I want is to take the date from the Salesforce server and not from the local machine.

QUESTION

Can I get the server's current date in the javascript controller without having an apex server call (like using $A or some other command)?

3
  • $A is aura, which is still a client-side framework, so even if that method exists it would return the browser time, and not the Org wide time/timezone, I would like to be wrong here though. Nov 26, 2018 at 10:28
  • @PranayJaiswal OK, but is there any other utility? Nov 26, 2018 at 10:29
  • Your best bet is to pass the value from server since you need server value.
    – RedDevil
    Nov 26, 2018 at 11:24

1 Answer 1

5

Anything you do client-side can be defeated by a sufficiently determined user. As noted by OWASP:

Be aware that any JavaScript input validation performed on the client can be bypassed by an attacker that disables JavaScript or uses a Web Proxy. Ensure that any input validation performed on the client is also performed on the server.

Also, more specifically, not only could they change their date, they could make local modifications to your script via GreaseMonkey or even the Developer Tools that are built-in to the browser. Even if you could get the server time, it wouldn't matter for your purposes, because it can be broken.

So, simply write the code that does the simple validation; if they defeat whatever you have in place, the server should catch the problem and return an error. For example, you might use force:recordData and put a validation rule on the object, or check the date in Apex code before committing changes to the database, etc.

3
  • Thanks @sfdcfox - you are right that my client code is always exposed, but you need to know really well your javascript to hack it. On the other hand, when the user sees a locked record because a field date overdue, it makes sense to try and change the date of the computer - no programming skills. This is why I am trying to avoid that problem. I will anyway adopt your suggestion to apply a validation rule - this is an excellent idea Nov 26, 2018 at 13:31
  • @ItaiShmida Changing the computer clock will prevent SSL from working correctly. In fact, Google Chrome reports an error "your computer clock is ahead/behind" and refuse to connect to websites. Trying to subvert your logic with a simple a clock change might result in not being able to use the internet at all.
    – sfdcfox
    Nov 26, 2018 at 16:27
  • I understand what you are saying, but in my testings, I change the computer date and all is well and I can 'hack' my development like that, I get no problems. The validation rule that I added did the trick and prevent from saving. Nov 27, 2018 at 7:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .