I know that general best-practice states not to trust anything generated by the client.
Let's say we're using an algorithm to generate some text for the purposes of this example.
The user then selects one or more of these text passages and the app sends them back to the server.
The algorithm for generating them necessarily exists client-side, as does the method for posting the data back to the server.
How can I verify that the data being posted to the server has been generated by the client-side algorithm and not simply edited in Firebug or developer tools? Any checksum/hashing algorithm I might use would also have to be present client-side and therefore vulnerable to tampering as well.
Can this be done without relying on the security-by-obscurity of 'hidden'
<input> fields and obfuscated code?