foreign to part two in this series of securing fields in servicenow in this video we're going to take a look at client scripts now the only reason I've included this topic in this series is because I want to emphasize that you should not use client scripts as a method for securing data in the now platform they are inherently insecure think about it they're executed after the query has been made to the database so the data resides in the client now there are some Glide 4 methods that are available to you such as set displays set visible set read only that you can use to hide fields and make them read only but that data is in the client it's there so it's inherently insecure let's take a look at some examples okay so the use case I've got here is this table called cars it contains some vehicle information and if we open up one of these records here in addition to the the location and the the make and the model of the car I've also got this field here pin now let's just assume there is a requirement that this field should be visible and writable only to admins only if you have the car's admin role and lots of car users so I'm currently logged in here as another user with the car user role and if I open up that same record I currently have access to that field pin all right so let's go to my client script here I've got a simple client script here that's going to perform a check to see whether the user has the car's admin role and if so display that pen field if you don't have that role you will not be able to see that field so let's activate that and save it and test it okay so if I refresh this page here we should see no change because I have the cars admin role and that works just fine okay if I go to the car user however and refresh this page we don't see the field anymore we did actually for a brief moment in time for about half a second it appeared and then disappeared so it's actually loaded in the client we've actually have access to that data just not we just don't see it in the browser because that client script has hidden it but there is a way that you can still see the value of that field so in Chrome I can just right click on this element here and go to inspect just to look at the source code for this page and if we take a close look at the source code here we can see we're only looking at that no pin field right there but if I go to the next div here the form group and just expand that and then expand this one here if you take a closer look here we can actually see the value right there for that field 593034 we don't display it in the form but if you're cluey enough you can actually see it in the source code so this is inherently insecure okay so let's take a look at another example let me go back to my admin user here I'm going to deactivate that script we no longer need that and let's come to the second example here called make pin writable for car admins only and it does exactly what it says so the script down here is similar to the one that we just saw only that the method here is set read only so it does the same thing in other words it checks first of all if you have a car's admin role if you do you've got right access to the field this time if you don't have that role you've got read access read only access rather okay so let me activate that and save that and we'll go ahead and test it okay so that's my car's admin user if I refresh this page there should be no difference I can see the field I can change this field okay currently it's set to 593034 if I go to my car's user however and just refresh this page we should be able to see the field this time but oops you can see there we could actually we did have right access to it again for about half a second before it changed to read only again that was the delayed response of that client script once it loaded it made that field read only okay so here if I click here there's no way I can change the field however there is still a way I can do it okay we've got that data loaded into the system now and at the moment there's nothing really preventing us from changing this field except for this browser page here it's not letting me do it so let's come again to the source for this page let me right click on the field pin and go to inspect and let's locate this value 593034 so if I expand this div here we can see the value again over here just like we did before so even though we can't change it here guess what we can actually change it here I can change that three four two five zero and hit enter guess what's going to happen that value has been changed now okay if I close this in the form it's five zero now it's still read only I haven't saved it yet but if I click on update that record is now saved with that value okay if I come back to my admin user that's the message I get confirming that that value has been changed so again client scripts insecure it's only determining what's happening on the client side not necessarily what's happening from the server and to the server let's take a look at a final example let me go back to servicenow studio and deactivate that script and let's have a look at the third one that I've got here which is called makepen read only when there is no pin okay in other words where that no pin field the one above it has been selected we should hide this field and make it read only this is what this script does here okay so it's like variation on what we've just seen uh the difference here also is that the type of the script is on chain so we're looking for a change to that no pin field that checkbox and depending on what value has been changed what it changes to we're going to make the pin field visible or not okay so let me activate that save it and once more we will test it okay so I'm going to come over to my form here and reload it at the moment there should be any change but as soon as I select no pin here it's going to have the effect of hiding that field okay if I deselect it it's back again okay if I do that as a user so if I open up the same record here we'll see the same functionality uh it can make the pin field appear and disappear just by checking that box there but again all this is happening on the client side you know that data is still loaded in the background so it may not necessarily be visible on the browser page but I can always come to look at the source code for that page to see any hidden values okay so the moral of this story is do not use client scripts for security okay it is no guarantee that your data will be secure as we've just seen in those simple examples you can actually still see and even potentially change data by looking at the source of the page itself okay certainly you can use client scripts for showing Fields hiding Fields making them read only for usability purposes there may be cases for that but definitely don't use them for security purposes okay hope you found this video helpful and we'll see you in the next one