Blazor wasm in memory question

[andersson09]

Hey, just a question regarding state in blazor wasm for a production site. Can in memory variables during runtime be read using a tool? I know variables known at compile time can be read (https://www.forcepoint.com/blog/x-labs/analyzing-webassembly-binaries), but for example can the counter increment (private int currentCount = 0;) from the demo be known after it has been clicked?

Thanks

[SteveSandersonMS]

Yes, definitely. As a user, you can use the browser dev tools to read the .NET heap directly (for example, by looking at Module.HEAP8 in the JS console).

[andersson09]

Thanks and can memory be overwritten? Im just a bit confused with the statement

"Since compiled code is immutable and not observable at runtime, WebAssembly programs are protected from control flow hijacking attacks" from webassembly.org.

Also, are there any ways of storing data into secure memory in blazor. I've looked at subtlecrypto and it implies cryptokeys are hidden from the user even when stored in indexeddb. But what is the point if the data you are encrypting is already in memory and can be read, or is the purpose of subtlecrypto nothing to do with user and more for encrypting data when sending to server? Sorry for all the questions but find it all a bit confusing.

[SteveSandersonMS]

Thanks and can memory be overwritten

Yes, it's a read-write array.

Also, are there any ways of storing data into secure memory in blazor

If your goal is to stop the user from accessing the data that's in their own computer's memory, then no, you can't do that. This is not Blazor-specific - it's true for all client-side technologies (besides DRM approaches). All browser-based applications are open for inspection and modification by their user.

is the purpose of subtlecrypto nothing to do with user and more for encrypting data when sending to server

Yes, that's what it's for (interacting with external servers).

[andersson09]

Thanks Steve, appreciate the answers.