The key thing that makes this kinda hard is the backend server isn't "trusted" and so it will have no access to literally anything.