Client vs Server

Client vs Server A architecture diagram generated by Archify. Browser: no Cookie, no JWT verify Origin: sole authorizer Web boot · immediately: true · Browser: no Cookie, no JWT verify Web boot immediately: true Wrap isLoopback · capability on · Browser: no Cookie, no JWT verify Wrap isLoopback capability on ui-settings · settings/describe · Browser: no Cookie, no JWT verify ui-settings settings/describe /api · settings/describe · Origin: sole authorizer /api settings/describe Server decision · JWT + Host/Origin · Origin: sole authorizer Server decision JWT + Host/Origin prefetch module Host persistence RPC policy decision allow or deny Legend Frontend Backend Security

Client

  • • Only wraps connection.isLoopback
  • • Does not infer login from Cookie
  • • Unload restores the original value

Server

  • • Verifies Cf-Access-Jwt-Assertion
  • • Rejects host.pickDirectory / host.openPath
  • • Is the sole authorizer