<p>All sensitive operations <em>must</em> be performed on your side. You cannot perform them on the client side and trust the client to pass you the correct information. If you need to call some API to get wallet information, your server needs to make that call.</p>

CC BY-SA 4.0
2020-01-27T11:35:25.403Z
David thanks. I'm surprised that I can't verify it off line given that I have the private key. Is there any alternative I can use like a different coin that will allow me to do this offline using the Ajax method with a browser client?
Skills
CC BY-SA 4.0
2020-01-27T11:39:36.583Z
One method I was thinking of is having the server create a new transaction and transfer all of the coins to a new wallet. I'm not sure but maybe I could validate the transaction object after it has been confirmed by the network. I would still have to query the network on the client side but since I'm the sender it would work. I'm not sure
Skills
CC BY-SA 4.0
2020-01-27T11:53:16.120Z
One thing I forgot about is I can try the callback API blockcypher offer. Maybe they can call my server when the transaction completes.
Skills
CC BY-SA 4.0
2020-01-27T10:15:18.443Z
2020-01-27T10:15:18.443Z
David Schwartz
<p>My scenario:</p>
<p>My web server:</p>
<ul>
<li>Generates private and public, and a wallet address from the public key for a user website account</li>
<li>Server can not connect to the outside (Can not connect to the Bitcoin network)</li>
<li>Has a page that allows anyone to send money to the user account wallet address</li>
</ul>
<p>What I need to do:</p>
<ul>
<li>The server needs to know when bitcoins were sent to the wallet address, and how many total bitcoins are at the wallet address</li>
</ul>
<p>Because web server can not access outside internet, I am using Javascript on the browser side to get the wallet address info by getting <a href="https://api.blockcypher.com/v1/btc/test3/addrs/miedePxMt4SDQHjWJyfhbCWvXcm33vzDa1/full" rel="nofollow noreferrer">https://api.blockcypher.com/v1/btc/test3/addrs/miedePxMt4SDQHjWJyfhbCWvXcm33vzDa1/full</a> and/or <a href="https://api.blockcypher.com/v1/btc/test3/txs/681b16b4de3676a5865a85e0bba3097afcc195d928f3167e4d5591c388c1e474?includeHex=true" rel="nofollow noreferrer">https://api.blockcypher.com/v1/btc/test3/txs/681b16b4de3676a5865a85e0bba3097afcc195d928f3167e4d5591c388c1e474?includeHex=true</a>  ... and sending that data to my webserver using a Ajax call to check for the received bitcoins.</p>
<p>Note: I have sent testnet bitcoins to that wallet.</p>
<p>Everything works except 1 problem: The browser user can easily change the bitcoin amounts and trick the web server into thinking more bitcoin were sent.</p>
<p>My question is: What methods can I use on the webserver to verify that the transaction data was not changed by the browser user. The web server has the pub/priv key of the receiving wallet. The webserver has the &quot;bx&quot; libbitcoin-explorer program available and I could potentially install other software.</p>
<p>Can I use the commands in this diagram at all? <a href="https://github.com/libbitcoin/libbitcoin-explorer/wiki/Transaction-Commands" rel="nofollow noreferrer">https://github.com/libbitcoin/libbitcoin-explorer/wiki/Transaction-Commands</a></p>

<transactions><address><transaction-verification><validation><verification>
How can a receiver verify that transaction data was not altered by 3rd party?
Skills
# How can a receiver verify that transaction data was not altered by 3rd party?

(Asked by: username_0 on 2020-01-27)

My scenario:

My web server:

* Generates private and public, and a wallet address from the public key for a user website account
* Server can not connect to the outside (Can not connect to the Bitcoin network)
* Has a page that allows anyone to send money to the user account wallet address

What I need to do:

* The server needs to know when bitcoins were sent to the wallet address, and how many total bitcoins are at the wallet address

Because web server can not access outside internet, I am using Javascript on the browser side to get the wallet address info by getting <https://api.blockcypher.com/v1/btc/test3/addrs/miedePxMt4SDQHjWJyfhbCWvXcm33vzDa1/full> and/or <https://api.blockcypher.com/v1/btc/test3/txs/681b16b4de3676a5865a85e0bba3097afcc195d928f3167e4d5591c388c1e474?includeHex=true> ... and sending that data to my webserver using a Ajax call to check for the received bitcoins.

Note: I have sent testnet bitcoins to that wallet.

Everything works except 1 problem: The browser user can easily change the bitcoin amounts and trick the web server into thinking more bitcoin were sent.

My question is: What methods can I use on the webserver to verify that the transaction data was not changed by the browser user. The web server has the pub/priv key of the receiving wallet. The webserver has the "bx" libbitcoin-explorer program available and I could potentially install other software.

Can I use the commands in this diagram at all? <https://github.com/libbitcoin/libbitcoin-explorer/wiki/Transaction-Commands>

**Tags:** transactions, address, transaction-verification, validation, verification


---

## 1 answers

### Answer by username_1 on 2020-01-27. Score: 1

All sensitive operations *must* be performed on your side. You cannot perform them on the client side and trust the client to pass you the correct information. If you need to call some API to get wallet information, your server needs to make that call.

> **Comments:**
> **username_0**: username_1 thanks. I'm surprised that I can't verify it off line given that I have the private key. Is there any alternative I can use like a different coin that will allow me to do this offline using the Ajax method with a browser client?  
> **username_0**: One method I was thinking of is having the server create a new transaction and transfer all of the coins to a new wallet. I'm not sure but maybe I could validate the transaction object after it has been confirmed by the network. I would still have to query the network on the client side but since I'm the sender it would work. I'm not sure  
> **username_0**: One thing I forgot about is I can try the callback API blockcypher offer. Maybe they can call my server when the transaction completes.  

---

