Passwords in Client-Side JavaScript (PicoCTF 2022 #14 'local-authority') 

You can send any response back to the client for any request type. The difference between post and get is that post is encoded as a body, where GET stores variables in the URL Using express routing you can send any response The server side is simply checking the hash - if post body contains hash, then it returns the login page, false it returns res.send("not authorized")

@@Channel-he5fr Yes, but in the video, the method was POST in the form. So, the first time he views source with method GET, but the second time it is POST because he submits the form, which then displays the javascript in the source. And the reason then why he cannot see the javascript the first time, is the GET method which is the standard method. ...but I just realized, that he actually explained what happened.

You said post method - which is allowed to send data back to the client Just providing additional information based on our experience configuring express routes

@@Channel-he5fr What I meant was, GET only send data back, while POST receives on the serverside and can send data back to the client too. GET is a one step process. POST is a two step process. GET is used to make database lookups for example, usually through query string, which is part of the URL and can therefore be indexed by search engines. POST can send query string too, but as you said, it can also send data in the body, and the response will also be hidden to search engines, so a page generated using POST will never be indexed. And this is one thing I use, if a request has a user agent of google for example, but uses method POST, then it is not a search engine so it gets a 404 in response. Search engines never use POST, because that is rightfully seen as internal, meaning private.