h5p / h5p-flashcards

7 stars 56 forks source link

User can see the right answer before replying - can we avoid it? #68

Open TiagoJacobs opened 3 years ago

TiagoJacobs commented 3 years ago

Hello, thanks for this amazing solution.

However I have one concern using it. If user inspect the network tab, it can see the content.json file, and this way see the expected answer for each question.

Is there any way to avoid this?

image

TiagoJacobs commented 3 years ago

Just to be clear, an exploit that any student could use would be adding something like this to chrome's console:


Object.keys(window.H5PIntegration.contents).map(content => JSON.parse(window.H5PIntegration.contents[content].jsonContent).cards.map(card => card.answer) )

So it will get all the answers: image

otacke commented 3 years ago

@tdjac0bs You are correct. There will always be ways to get hold of the solutions when using software that evaluates the answers in the browser. The H5P core team has server-side evaluation on the roadmap for H5P however, see https://h5p.org/roadmap