I'm building a browser-based application with Rust and WebAssembly. The idea is that users' browsers connect to one another and exchange data, then verify it using hashes or Merkle-tree-style checks. For example, a browser might receive data A from several peers, later receive data B, compare their hashes, and share the result with other browsers.
Can a malicious user modify the WebAssembly, JavaScript, browser extension, or network traffic so their client sends incorrect data or falsely reports that data is valid? Is there any reliable way for the application or other browsers to detect that a user has altered the client-side logic and warn everyone else?
3 Answers
Put security-critical validation on infrastructure you control. Treat every request and every value from a browser as potentially hostile, validate it on the server, authenticate users when appropriate, and enforce limits so malformed or repeated requests cannot cause damage. Client-side checks are useful for user experience, not for trust.
A browser extension would not solve this. Extensions can also be modified, disabled, or replaced, and users can use developer tools or another client altogether. If the client must be trusted for the system to work, the design needs to change so that untrusted clients cannot unilaterally determine the result.
Exactly. You can still let browsers exchange data for efficiency, but any important result should be checked by a trusted service or by a protocol whose security does not depend on honest client code.
Yes. Anything executed on the user’s device has to be treated as untrusted. They can modify the WebAssembly or JavaScript, inspect and replay network requests, send fabricated responses, or skip the browser entirely and write a separate program that communicates with your service. WebAssembly makes code harder to inspect in some cases, but it does not create a security boundary.
So the main option is to have a server independently validate the data instead of trusting the browser’s verification result?