Everything, even your javascript source code is visible to the client and can be it probably to generate and send a UUID alongside it, and check on return that .