AngularJs scope variables in console

Question

I know that we can access scope variables with batarang (chrome extension) and angular.element(document.querySelector('selector')).scope()

I managed to access areas, controllers, in angular.io , angularjs.org

But I came across the angularJs website ( www.paytm.com ), which can block me from accessing scope variables in the console, also the controller, etc.

• How to block users from access to scope variables?
• Even if I block, is there a way for users to access scope variables?
• Will I have additional protection if I block users from accessing the area data?

Answer 1

The site uses

 $compileProvider.debugInfoEnabled(false) 

The main goal is to improve application performance .

Although this may be (weakly) considered part of countermeasures against RE, I seriously doubt that this will be a problem for any programmer who can reverse engineer obfuscation of an application. If you are not inclined to compromise the code, do not use it on the client side.

Even if I block, is there a way users can access variables in the area?

Sure.

 var scope; angular.element(document.body).injector().invoke(function ($rootScope) { scope = $rootScope; console.log(scope); }); 

Or just angular.reloadWithDebugInfo() , as follows from the above guide.

Answer 2

I can’t comment because I don’t have enough reputation, but although I can’t answer your first question, I can talk about two others:

2. Even if I block, is there a way for users to access scope variables?

Yes. Each time you run the application code on a client computer, you can access information about what works. This is true for every client-side code.

While you can try to complicate the detection of data for cybercriminals, you cannot really protect it from any harm.

In the specific case of angularjs applications, remember that your code is accessible from a browser, and any user can use it (even if it is connected and minimized!). Thus, reverse-engineering an application and running it in a controlled environment would not be too complicated.

3. Will I have additional protection if I block users from accessing the area data?

Well, that is debatable. As I explained in 2, it will still be possible to access your scope variables, it can be trickier. I think the real question here should be: "Does it bother me if anyone has access to my scope variables?"

The answer to this question must always be decisive. What reasonable information do you keep on the client side? Should it be there? Remember that all reasonable information must be stored in encrypted form and transmitted only through the network in encrypted messages. If there is some logic on the client side that you absolutely cannot allow access to, it should be on the server side. And this is the answer to most reasonable information issues you can find.

TL; DR: People will still be able to access your area. You must design your application so that you don’t worry about it.