How to disable JavaScript function calls from the browser console?

Is there a general way to disable functions call from console?

No. there isn’t: Never. Well, apparently, Facebook found a way in Google Chrome to do so: How does Facebook disable the browser’s integrated Developer Tools? – though, I would consider it a bug 🙂

Is it maybe something else that I have ignored?

Yes. JavaScript is executed client-side, and the client has the full power over it. He can choose whether or not to execute it, how to execute it and modify it as he wants before executing it. Modern developer tools allow the user to execute arbitrary functions in arbitrary scopes when debugging a script.

You can make it harder to introspect and use (call) your code by avoiding to expose your methods in the global scope, and by obfuscating (minifying) the source. However, never trust the client. To avoid cheating, you will have to perform all crucial task on the server. And don’t expect all requests to come from your JavaScript code or from a browser at all; you will need to handle arbitrary requests which might be issued by some kind of bot as well.

Leave a Comment