Security Notes

Security Notes

CEF UI is client-side. Treat every browser event as untrusted input.

Validate all JS -> Pawn events

When JavaScript emits an event:

cef.emit("shop:buy", itemId, amount);

The server must validate:

• player is logged in
• player can access the shop
• player is close enough to the shop NPC/object
• item exists
• amount is within allowed range
• player has enough money
• cooldown/rate limit is respected

Do not trust browser state

The player can potentially tamper with their local UI.

Do not use CEF only to enforce:

• money
• inventory
• admin permissions
• anti-cheat checks
• item ownership
• location checks

The server remains authoritative.

Avoid exposing secrets

Do not place secrets in:

• HTML
• JavaScript bundles
• frontend environment variables
• CEF resources

Packaged resources are not a safe place for secrets.

Event naming

Use scoped event names and validate only registered events:

login:submit
inventory:move
shop:buy
vehicle:radio:set_url

Resource hygiene

When using frontend build tools:

• avoid shipping source maps in production if they expose sensitive internals
• avoid unused debug pages
• avoid hardcoded API tokens
• validate any URL submitted by players

External URLs

If you load external websites, consider:

• performance
• autoplay/audio policies
• tracking/privacy
• mixed content
• broken external assets
• abuse through user-provided URLs