3 ms·
Yes, this is my misunderstanding, if the calling code (client code) has the "if" with the secure block in the curly braces that should not be executed. A clien
by rileymat2 1y ago
Yes, this is my misunderstanding, if the calling code (client code) has the "if" with the secure block in the curly braces that should not be executed.
A client side attack can just jump over that server call in a variety of ways, from mitm to running in a debugger to patching it out.
- chrysoprace 1y agoIt'd be no different from a fetch request. The inside of the function (the conditional) is run on a different machine with a different runtime process.
- Izkata 1y agoThey're not asking "how does this work?", they're asking "how is this secure?". The answer is, it's not. This is terrible code and should never be written like this - the check can be bypassed client side, letting the user act as an owner no matter what the response claimed.