Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I know that general best-practice states not to trust anything generated by the client.

With that in mind, I want to write an HTML5 app that utilises the browser to generate various objects client-side before sending them back to the server. These could be images, text, numbers, whatever - but all of them generated by client-side JavaScript, so as not to burden the webserver and keep things responsive.

Let's say we're using an algorithm to generate some text for the purposes of this example.
The user then selects one or more of these text passages and the app sends them back to the server.

The algorithm for generating them necessarily exists client-side, as does the method for posting the data back to the server.

How can I verify that the data being posted to the server has been generated by the client-side algorithm and not simply edited in Firebug or developer tools? Any checksum/hashing algorithm I might use would also have to be present client-side and therefore vulnerable to tampering as well.

Can this be done without relying on the security-by-obscurity of 'hidden' <input> fields and obfuscated code?

share|improve this question

1 Answer 1

up vote 5 down vote accepted

You can't prove it, no. It's on the client machine, so any code or data you hand them is theirs to change. At best you can make it difficult, with obfuscation and DRM techniques, but that's likely to introduce other problems.

The only solution to this problem is to perform operations on the server.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.