Apps Script Private functions

Question

In Google apps script documentation, there is a page about Private functions on server side. That should explain that without private functions, the server code is visible from the user browser. Can anybody explain how you can see such server side functions in a browser ? Thanks

See : https://developers.google.com/apps-script/guides/html/communication#private_functions

Answer 1

The server code is never visible on the user's browser, only the functions names. Private functions hides those names, but more importantly they remove the ability from the frontend to call them directly.

In other words, private functions allow you to define your backend entry-points, preventing a malicious user to bypass some checks you might have and call your "internal" functions directly.

To showcase how easy it is to see the name and call any non-private backend function, I've put up this example where we inspect the google.script.run object:

function myFunction() {}

function anotherFunction() {}

function privateFunction_() {}

function doGet() {
  return HtmlService.createHtmlOutput(
    '<p id="output"></p>'+
    "<script>var s = ''; for( var prop in google.script.run ) s+=prop+'<br>';"+
    "document.getElementById('output').innerHTML = s;</script>"
  );
}

Here's this example published: https://script.google.com/macros/s/AKfycbzk0d03iB1O3vVYVD_U7eONM357iOPlAn7RFxAeZKx34q1Ones/exec

And its source code (same as above): https://script.google.com/d/1WMY5jWblGl8U84WvVU_mZjHDg-6rGOoOPnKMF6m2bS_V-2g6IChBVDrg/edit

-- to address a question in the comments

The doGet function cannot be made private since its name is fixed/predefined. But that is not really a problem as this function is supposed to be an entry point anyways, and since you expect it to be called from the users' browsers and can do your parameters checks and such accordingly.