The server generates and returns an arbitrary token, which is typically a hash or A few other fingerprint in the contents on the file. The browser would not have to understand how the fingerprint is generated; it only should send it on the server on the next ask for. In https://alfredg219kxj2.wikigop.com/user