{"licence":{"name":"CC BY-SA 4.0","spdx":"CC-BY-SA-4.0","url":"https://creativecommons.org/licenses/by-sa/4.0/","attribution":"Atlas, a bilingual technical dictionary (https://cmaintz.github.io/tech-atlas/)"},"id":"cs/client","url":{"en":"https://cmaintz.github.io/tech-atlas/en/terms/cs/client/","da":"https://cmaintz.github.io/tech-atlas/da/terms/cs/client/"},"term":{"en":"Client","da":"Klient"},"aka":{"en":[],"da":[]},"domain":["cs"],"cluster":"networking","layer":"network","status":"current","summary":{"en":"The program or device that starts a network exchange by sending a request, such as a web browser asking for a page.","da":"Det program eller den enhed, der starter en udveksling over et netværk ved at sende en forespørgsel, fx en browser, der beder om en side."},"body":{"formal":{"en":"The party in a network exchange that opens the connection and sends requests, following a shared protocol, to a server that waits and replies. The role is defined by who starts the exchange, not by the kind of machine.","da":"Den part i en udveksling over netværket, der åbner forbindelsen og sender forespørgsler efter en fælles protokol til en server, som venter og svarer. Rollen afgøres af, hvem der tager initiativet, ikke af, hvilken slags maskine det er."},"plain":{"en":"Like a customer walking up to a shop counter - the customer asks, the shop answers, and it is always the customer who starts.","da":"Som en kunde, der går hen til disken i en butik - kunden spørger, butikken svarer, og det er altid kunden, der begynder."},"inPractice":{"en":"In a municipality's citizen service, the program on a clerk's PC is a client - each time she looks up a citizen, it sends a request to the central case system and shows the reply.","da":"I en kommunes borgerservice er programmet på sagsbehandlerens pc en klient - hver gang hun slår en borger op, sender det en forespørgsel til det centrale sagssystem og viser svaret."},"whyItMatters":{"en":"Clients run on the devices people use every day and process whatever comes back to them, so a tricked or outdated client is often how an attacker first gets inside.","da":"Klienter kører på de enheder, folk bruger hver dag, og behandler alt, hvad der kommer tilbage til dem, så en narret eller forældet klient er ofte angriberens første vej ind."}},"deepDive":{"en":"At the socket level the client is the active opener. With the Berkeley/POSIX sockets API a TCP client calls socket() and connect(); the kernel picks an ephemeral source port and sends a SYN to the server's address and port, whereas the server has called bind(), listen() and accept() and is waiting passively. The connection is identified by the 5-tuple (protocol, source IP, source port, destination IP, destination port), and it is the client's ephemeral port that lets one host keep many simultaneous connections to the same server port. UDP has no connection, but the convention is the same: the client sends the first datagram, and the server replies to whatever source address and port it observed.\n\nThe role is defined per protocol exchange, not per machine. A reverse proxy is a server towards browsers and a client towards the origin; a recursive DNS resolver is a server to the stub resolvers on laptops and a client to authoritative name servers; a mail server relaying outbound mail acts as an SMTP client. In peer-to-peer protocols every node plays both roles. HTTP (RFC 9110) calls the originating client program a user agent, and the User-Agent header it sends is self-declared and trivially spoofed, so it is useful for statistics but worthless as an authentication signal.\n\nThe initiator role has direct security consequences. Stateful firewalls and NAT normally permit outbound connections and their replies while dropping unsolicited inbound traffic, so malware deliberately behaves as a client: reverse shells and command-and-control implants beacon outwards over HTTPS or DNS to pass perimeters that would block an inbound connection. Server-side request forgery (SSRF, OWASP Top 10:2021 A10) is the mirror image, where an attacker makes a server act as an unwitting client of internal systems. Client software is also a large attack surface in its own right: browsers, mail clients, PDF readers and VPN clients parse untrusted data returned by servers, and a malicious or compromised server can exploit that parsing.\n\nThe basic design rule is that a server must never trust the client. Input validation, price calculation or authorization logic implemented only in JavaScript or in a mobile app can be bypassed with a modified client or an intercepting proxy, so it has to be enforced again on the server. In ordinary TLS only the server is authenticated; the client proves its identity at the application layer with passwords or tokens or, in mutual TLS, with its own X.509 certificate. Operationally, governing clients means keeping them patched, inventorying the client software in use (CIS Controls v8, Control 2) and, in Zero Trust designs, checking device posture before a client is allowed to reach a service.","da":"På socket-niveau er klienten den aktive part, der åbner forbindelsen. Med Berkeley/POSIX-sockets kalder en TCP-klient socket() og connect(); kernen vælger en flygtig (ephemeral) kildeport og sender en SYN til serverens adresse og port, mens serveren har kaldt bind(), listen() og accept() og venter passivt. Forbindelsen identificeres af 5-tuplen (protokol, kilde-IP, kildeport, destinations-IP, destinationsport), og det er klientens flygtige port, der gør det muligt for én maskine at have mange samtidige forbindelser til den samme serverport. UDP har ingen forbindelse, men konventionen er den samme: Klienten sender det første datagram, og serveren svarer til den kildeadresse og -port, den så.\n\nRollen afgøres for hver enkelt protokoludveksling, ikke af maskinen. En reverse proxy er server over for browserne og klient over for de bagvedliggende servere; en rekursiv DNS-resolver er server for stub-resolverne på de bærbare og klient over for de autoritative navneservere; en mailserver, der videresender udgående post, optræder som SMTP-klient. I peer-to-peer-protokoller spiller hver knude begge roller. HTTP (RFC 9110) kalder det klientprogram, der sender forespørgslen, en user agent, og den User-Agent-header, det sender, er selvdeklareret og let at forfalske - brugbar til statistik, men værdiløs som grundlag for autentifikation.\n\nHvem der tager initiativet, har direkte sikkerhedsmæssige konsekvenser. Stateful firewalls og NAT tillader normalt udgående forbindelser og svarene på dem, men afviser uopfordret indgående trafik, og derfor opfører malware sig bevidst som klient: Reverse shells og command-and-control-implantater kalder udad over HTTPS eller DNS for at komme forbi en perimeter, der ville blokere en indgående forbindelse. Server-side request forgery (SSRF, OWASP Top 10:2021 A10) er spejlbilledet, hvor angriberen får en server til ubevidst at optræde som klient over for interne systemer. Klientsoftware er desuden en stor angrebsflade i sig selv: Browsere, mailklienter, PDF-læsere og VPN-klienter fortolker data, der kommer fra servere, og en ondsindet eller kompromitteret server kan udnytte fejl i den fortolkning.\n\nDen grundlæggende designregel er, at en server aldrig må stole på klienten. Inputvalidering, prisberegning eller adgangskontrol, der kun ligger i JavaScript eller i en mobilapp, kan omgås med en modificeret klient eller en opsnappende proxy og skal derfor håndhæves igen på serveren. I almindelig TLS er det kun serveren, der autentificeres; klienten beviser sin identitet i applikationslaget med adgangskoder eller tokens eller, ved mutual TLS, med sit eget X.509-certifikat. I driften handler styring af klienter om at holde dem patchede, have overblik over den klientsoftware, der er i brug (CIS Controls v8, Control 2), og i Zero Trust-arkitekturer at kontrollere enhedens tilstand, før klienten får lov at nå en tjeneste."},"edges":[{"type":"requires","to":"cs/network","confidence":"high","strength":"normal"},{"type":"requires","to":"cs/protocol","confidence":"high","strength":"normal"},{"type":"contrasts-with","to":"cs/server","why":{"en":"The client asks and starts the exchange; the server waits and answers. The same machine can play either role.","da":"Klienten spørger og starter udvekslingen; serveren venter og svarer. Den samme maskine kan spille begge roller."},"confidence":"high","strength":"primary"}],"depth":2,"sources":[{"title":"Kurose & Ross, Computer Networking: A Top-Down Approach","tier":"textbook"}],"draft":true}