0

I have a desktop app that takes a file format and parses it to get some JSON data that is then send to a server.

My problem is figuring out if it is possible to somehow parse the data on the client and then send this JSON data to the server while being somewhat sure that this JSON data was not modified by the client manually.

I can have the client upload the file to the server and then have the server parse it but the file is big and expensive to parse.

This is a not a serious application (hobby project) and it is indeed possible for the client to manipulate the file format itself which will result in bad data anyway.

1 Answer 1

1

It depends on the file format.

Generally, no.

Suppose the large file is a document and the interesting data is the author's name.

The client could be lying in what author was contained in the large file.

However, do note that if the file was parsed in the server, the client might have generated a fake document with the author field that it wanted to report to the server.

So, you would need to trust the client either way.

This changes if the contents could be verified somehow. For instance, if the document contained an embedded signature, the server could verify that the document hasn't been tampered with (the signature is correct), and then parse and extract the author.

A signature covering the full file would only be useful if the whole file was sent to the server. If the interesting data had its own signature, the client could transmit the JSON along the signatures for just those fields, which would allow the server to verify it while receiving just a tiny portion.

If you control the file format, you can design it so that it is possible to verify those fields separately. Otherwise, you would need to trust the client.

1
  • Part of the file is encrypted with Blowfish(with the key being somewhat public, so I am not sure why it is encrypted in the first place). It looks like my best option is to simply have the user upload the file to server and do everything from there. Thank you for your help!
    – dacite
    Commented Sep 16, 2022 at 18:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .