1

I've been spending a lot of time testing and debugging JavaScript that runs for online exams. Occasionaly I will find the user was using a browser plugin that changed the behaviour or display or caused errors in a quiz, mostly plugins that help with spelling, grammar, or accessibility. But I also know some students will pay for online cheating services, and I'd like to try and re-write some of the Javascript to make it less error prone to browser plugins injecting functions and objects with the same names, but also harder if any online cheating services wanted to hook into the existing code to modify it's behaviour.

(Note1: The concern with plugins from online cheating services is not always that they will help the students, but also that they could sabotage the students when they are making legitament attempts without the students realising, forcing the students to rely on them more for other exams.)

(Note2: No correct answers are stored on the page, all marking is done on the server side.)

(Note3: All code is added to an open source project, and I don't want to obsucate to code, because that would then make it harder to debug legitament issues.)

Is there a way to see what browser plugins are running on a page? Is there a way to see if any other code is running on a web page? In some cases it has looked like the quiz JavaScript objects have been overridden, so something like the "object.toString();" might not return the value expected would changing code to something like "String(object).valueOf();" prevent methods from being overloaded to change the existing codes behaviour? Are there operators in JavaScript that can't be overridden?

user802599
  • 787
  • 2
  • 12
  • 35
  • Not in general. Anything that needs to be protected from tampering must run on the server. Anything you try to do on the client can be bypassed by going into Developer Tools. – Barmar Jun 18 '23 at 02:12
  • Avoid global variables, use modules (either ESM or IIFEs). Use content security policies to allow only your own scripts and to detect modifications. Look at unusual global variables being injected, look for modifications of the DOM that you didn't do yourself. – Bergi Jun 18 '23 at 03:31

1 Answers1

0

Going off the last part of your question, there are actually ways to detect the users browser plugins. As for preventing methods/objects to be modified, you can apparently use Object.freeze(), for operators though, I couldn't find anything. Hope this helps!

hidude562
  • 18
  • 5