...is a myth for client-side code. I'm not just talking about the fact that all your source code is right there for anyone to see (uglified or not). Your active memory is all available to every javascript debugger on the planet. Your every command to or from the server can be intercepted and/or spoofed. You can't trust anything on the client.
Yet i still see people talk about client security as important. Sanitizing inputs, not executing scripts added via innerHTML, blocking cross origin resource loading, hiding variables in closures. None of these things actually stop a malicious user (or innocent user with a compromised system) from doing anything and everything they want in the browser. Seriously, anything they want.
Granted, every one of these things make it harder, and making life harder for the bad guys is a good thing. I'm not opposed to any of these measures. But while useful and good, none of these browser "security" measures actually make your client-side app safe. The only thing you can actually secure is the server.
Never rely upon your client code to validate, sanitize, prevent or secure anything of importance. There is no security in the browser. Once it's off your server, it is out of your hands. End of story. Anyone suggesting otherwise is likewise not to be trusted. :)
