Global window integrity in Javascript

Question

I am working with online games in browsers and need to make the client a safer environment...

Initially I think of the root that is the Global window, how to maintain its integrity before its values already defined by the browser but with possibility to change, example:

by: https://stackoverflow.com/questions/11403107/capturing-javascript-console-log

let oldLog = console.log;

    console.log = function (message) {

            // DO MESSAGE HERE.

            // CODIGO CAPITURA
            oldLog('CAPITURA')

            oldLog.apply(console, arguments);

    };

    console.log('teste')

I know I can’t freeze all properties but I intend to freeze native functions and values if possible, immutable values, so I use existing functions and gain performance decreasing memory cost...

communicate with the server sent to the data stack to return the unique value integrity keys or other way that I do not know yet... there are other security factors like Global window and very delicate and great, I have a long way to go...

I would like to update some information, I found something very interesting of one of the engineers of Google, practices that really leave the code private and safe besides being efficient in the cleaning of memory, applied with Iifes:

https://philipwalton.com/articles/implementing-private-and-protected-members-in-javascript/

Answer 1

Some ideas that are used to make the code more secure (the first refers to your example, and properties of window) :

• records the window properties as immutable

At work we did so:

 const defineConstantProperty = function(key, value){
    Object.defineProperty(window, key, {
        value: value,
        writable: false,
        enumerable: true,
        configurable: false
    });
};

defineConstantProperty('propriedade', {% valor %});

and you can even test that in your example:

const defineConstantProperty = function(key, value, obj) {
  Object.defineProperty(obj || window, key, {
    value: value,
    writable: false,
    enumerable: true,
    configurable: false
  });
};

defineConstantProperty('console', console);
defineConstantProperty('log', console.log, console);

let oldLog = console.log;

console.log = function(message) {
  oldLog('CAPITURA')
  oldLog.apply(console, arguments);
};

console.log('teste')

• use Iifes to avoid variables in the global scope (you can read more here)

• use const to prevent variables from being written

• use let and const the advantages of its block scope

• never trust what comes from the client, always check on the server

• avoid having sensitive information in Urls or variables, always use indicators (ids you can use on the server) instead of sensitive information