Immutable object save file in javascript

Question

I am currently exploring different processes for saving a javascript object generated by a user.

One option I am exploring is to require the user to save their data to a file, that they can later re-upload to the website to continue working on.

Problem is, I need a way to ensure that the save file cannot change between download and re-upload.

Making a save file with javascript is possible .

Freezing objects is possible , but I am not sure if this will prevent the user from manipulating the data before re-upload.

Is there a way to save a JSON object to a file and prevent the user from editing the file?

Answer 1

If you save an object locally onto a users HHD you cannot make it tamper-proof. They always have the ability to edit it no matter what.

You can however make it so you can test whether it's been tampered with using checksums and hashes and the like.

If your site knows when this has happened then it's easy - you can just check the file hash value against your value and if they're the same allow the user to pick up where they left off.

If it's being done anonymously then your file generation process must have its own encrypted/unknown checksum process attached to the file. Then on upload check again to see if tampering has occurred.

Again, I suggest you think in terms of DETECTING alteration rather then PREVENTING alteration.

Answer 2

Essentially what you want is a checksum to also be generated and verify against that. You can read more about methods to do so here: https://en.wikipedia.org/wiki/File_verification

If you truly wish to ensure the file has not been tampered, you will need to store the checksum results somewhere else that the user can't access.