Lately there has been a lot of servers that would kick you for opening devtools. This might sound like an elegant solution for stopping “cheaters” calling your NUI callbacks with their own data. However it ISN’T
Would you ban knifes because people can kill each other with them? No you wouldn’t, you would concentrate on the core of the problem, why do people even kill in the first place. You can’t just ban the tool because they can be used in a bad way. The same thing applies for devtools, you can open devtools on any webpage you visit and can change anything you want. That looks like a big security risk doesn’t it? Yes you could abuse devtools on the web the same way as you can abuse it on FiveM but there’s one big difference, websites do have some standards they follow and the biggest one of them is that you don’t trust the client, you should threat the client only as a renderer and nothing else. Everything else has to be done on the server, except for one thing. You might need to get some data from the client as in an input, for example their name, you can’t just get their name without them giving it to you. That’s when you actually get data from the client, but that doesn’t mean these data are safe, not at all. You should never think that the client will always give you the data you want, you need to always check if the data you got is what you want. The same thing should apply to FiveM, and it does. However people are not following this and actually trust the client, which then results in people sending whatever data they want to the server and the server will actually accept it, for example you have an event which you triggers every time you complete a job, a lot of scripts get the amount of the money it should give you from the client, which means anyone can just call that event and say to the server that it should give you 9 million dollars, and it will! Instead of that bullcrap the server should be the one knowing how much money it should give you.
So what should you instead of blocking devtools on your server? Protect your NUI callbacks, never send any data from NUI to your server without verifying the data. If you block devtools instead you will most likely just leave these callbacks unprotected, and anyone little bit smarter can bypass your devtools check as it’s still the client telling the server if you opened devtools or not.
Now I’m going to prove you that you can very easily bypass your shitty devtools “protection”. There are many ways which could be used to bypass this “protection”
Just block the request.
In devtools you can easily block any request with a specific url. Open devtools and the network tab before you join the server, then you join the server and get kicked. After you get kicked you should see the request that kicked you in the list, just right click on it and press Block request URL or you can block the whole “domain” to block any request from that resource!
Block “__defineGetter__” in every iframe created
You can also just block the function that even registers if you opened the devtools in the first place. This method is prefered as you don’t need to get kicked. Just open devtools before you join the server and write this code snippet in the console.
let mutation = new MutationObserver(function (e) {
if (e[0].addedNodes && e[0].addedNodes[0]) e[0].addedNodes[0].contentWindow.Object.prototype.__defineGetter__ = () => {}
});
mutation.observe(document.body, { childList: true });
What does this code do? It listenes to any change in the DOM and if there’s any change it will automatically remove defineGetter in that window object, as the only elements that get created at the top context are iframes we shouldn’t get an element that wouldn’t have contentWindow. And if there is one element that doesn’t it would just throw an error however nothing should break.
Just disable javascript lol 4HEad (Not recommended)
When you open devtools and press ctrl shift p a little input box will popup where you can write Disable javascript and it will completely disable javascript in your NUI. I didn’t test if it breaks anything when you join the server however expect a lot of shit on the server not working if you do this.
