> That is, it would seem that both in principle and in practice a malicious user could have their computer send my Web server any bytes at all and that the JSC

> That is, it would seem that both in principle and in practice a malicious user could have their computer send my Web server any bytes at all and that the JSC code would be no protection for my server??? Correct, you protect the server on the server, but many servers run on javascript. Disclaimer: I have not read the book and don't know if it's any good.