The Glass Door — Defense Range

Peek inside

Here is a pretend vault on a pretend website. Open the Inspector and read what it is made of. This is not breaking in. It is just looking.

vaultbox.example

🔒

Members only

🔎 Inspector

// press the button to look inside

Anything your browser shows you, you can read. The page has to keep its rules somewhere your browser can use them, so you can find them too.

The fake lock

This vault checks the code inside your browser. Find two ways in.

vaultbox.example

🔒

Locked.

🔎 Inspector · runs in YOUR browser

// this code runs on your screen const code = "4921"; // the answer is right here let forceOpen = false ; function tryOpen(x){ if (x === code || forceOpen) open(); }

The lock that holds

Same vault, one change: the real check now happens on the server, somewhere your screen cannot reach. You are a real member. Your code is 4921. First try to cheat. Then enter it the honest way.

vaultbox.example · server mode

🔒

Locked.

🔎 Inspector · runs in YOUR browser

// this code runs on your screen let forceOpen = false ; // the server ignores this function tryOpen(x){ sendToServer(x); } // the real check lives on the server: 🔒 [hidden] you cannot see or change this

You just learned a real job

Trusting the browser to enforce the rules is one of the most common mistakes on the whole internet. People are paid to find it and fix it. You just did both.

🧪 See it for real (safe)

Right-click this box and choose Inspect. You will see its real code. Change a word, then look at the page. It changes only on your screen, and only until you reload. Your browser trusts you on your own screen. That is why a careful website never trusts your browser.

The one rule: check it on the screen to be friendly, check it on the server to be safe.