How to Prevent Objects from Being Modified in JavaScript

#javascript #security #tutorial

JavaScript objects are mutable by default. That means once an object is created, any code can change its properties—add new ones, delete them, or update values.

But in many situations, you don’t want objects to change.
For example:

Configuration objects that must remain consistent
Shared data structures in teams
API responses that shouldn’t be mutated
Security-critical values
Immutable state management (React, Redux, etc.)

JavaScript provides several techniques to restrict or completely prevent modifications.

This article covers all major methods—from shallow protection to deep immutability, including code examples so you know exactly how and when to use each.

Methods to Prevent Object Modification

JavaScript offers three primary methods with increasing levels of restriction:

Object.preventExtensions()

Object.seal()

Object.freeze()

1. Object.preventExtensions()

This method prevents new properties from being added to an object, but allows modification and deletion of existing properties.

const user = {
  name: "Sagar",
  age: 30
};

Object.preventExtensions(user);

// Existing properties can still be modified
user.age = 31; // Works fine
console.log(user.age); // 31

// Existing properties can be deleted
delete user.name; // Works
console.log(user.name); // undefined

// New properties cannot be added
user.email = "sagar@example.com"; // Fails silently in non-strict mode
console.log(user.email); // undefined

// In strict mode, it throws an error
"use strict";
user.phone = "123-456-7890"; // TypeError: Cannot add property phone

2. Object.seal()

Sealing an object prevents adding or removing properties, but allows modification of existing property values.

const config = {
  apiUrl: "https://api.example.com",
  timeout: 5000,
  retries: 3
};

Object.seal(config);

// Existing properties can be modified
config.timeout = 10000; // Works
console.log(config.timeout); // 10000

// Cannot add new properties
config.debug = true; // Fails silently (or throws in strict mode)
console.log(config.debug); // undefined

// Cannot delete existing properties
delete config.retries; // Fails silently (or throws in strict mode)
console.log(config.retries); // 3

// Check if sealed
console.log(Object.isSealed(config)); // true
console.log(Object.isExtensible(config)); // false (sealed objects are also non-extensible)

3. Object.freeze()

This is the strictest method. It makes an object completely immutable—you cannot add, remove, or modify properties.

const constants = {
  PI: 3.14159,
  MAX_SIZE: 100,
  APP_NAME: "MyApp"
};

Object.freeze(constants);

// Cannot modify existing properties
constants.PI = 3.14; // Fails silently
console.log(constants.PI); // 3.14159

// Cannot add new properties
constants.MIN_SIZE = 10; // Fails silently
console.log(constants.MIN_SIZE); // undefined

// Cannot delete properties
delete constants.APP_NAME; // Fails silently
console.log(constants.APP_NAME); // "MyApp"

// In strict mode, all modifications throw errors
"use strict";
constants.MAX_SIZE = 200; // TypeError: Cannot assign to read only property

// Check if frozen
console.log(Object.isFrozen(constants)); // true
console.log(Object.isSealed(constants)); // true (frozen objects are also sealed)
console.log(Object.isExtensible(constants)); // false