3 ms·
Not necessarily. You store which random number you sent to the client in the session on the server. Once it's been solved you invalidate it.
by underwater 16y ago
Not necessarily. You store which random number you sent to the client in the session on the server. Once it's been solved you invalidate it.
- tomstuart 16y agoHow do you know that the response really is the smallest such integer, rather than a precomputed one (e.g. the largest int with a hash beginning "0000")?
- JoachimSchipper 16y agoYou don't (have to) care about "the smallest", just "any integer with a hash beginning with 0000".
- tomgallard 16y agoBut once the spamming machine has worked that out once, they can submit the same integer every time. It would be better if the server sent a request saying send me an integer which has a hash beginning with npqr where n, p q and r are all random characters.