Securing pure Ajax/Javascript client

Question

We are creating an online service divided like that: - an API, of course - full JS/AJAX client, no MVC, it is pure JS

We are experienced developers and we do know that we can't secure the JS client code, however, we are trying to figure way to prevent 3rd parties from creating their own client by analyzing our JS API Call and this way restrict access only from our own client.

Thanks in advance!

You will not be able to do that.

Pointy
– Pointy

2012-10-23 23:01:27 +00:00
Commented Oct 23, 2012 at 23:01 — Pointy
– Pointy, Commented Oct 23, 2012 at 23:01
Impossible. One can always observe the http communication.

Sven
– Sven

2012-10-23 23:03:15 +00:00
Commented Oct 23, 2012 at 23:03 — Sven
– Sven, Commented Oct 23, 2012 at 23:03

jAndy · Accepted Answer · 2012-10-23 23:01:37Z

2

We are experienced developers and we do know that we can't secure the JS client code, however, we are trying to figure way to prevent 3rd parties from creating their own client by analyzing our JS API Call and this way only restreint access from our own client.

That is contradiction in terms. If you know that client-side ECMAscript code can never be hidden, it will always be possible for any somewhat experienced developer to analyse your code. Even if heavily obfuscated, minified and uglified.

Use a server-side authentication, by password. Its the only secure way. You just can not prevent that somebody will clone/copy your script.

answered Oct 23, 2012 at 23:01

jAndy

237k57 gold badges313 silver badges363 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

SlashJ Over a year ago

Well, i thought we were missing something, somwhere. We can always send 'Cease and Desist' but i tried to avoid this solution. :(

jarchuleta · Accepted Answer · 2012-10-23 23:02:23Z

0

I don't think you can. Perhaps generate a key or something to authorize requests.

answered Oct 23, 2012 at 23:02

jarchuleta

1,2398 silver badges10 bronze badges

Comments

DanRedux · Accepted Answer · 2012-10-23 23:03:37Z

0

For you and anyone with a similar question, take heed; it is impossible. If you send a user working code that will communicate with your API, there is nothing you can do to stop then modifying or re-writing that code. The only area you can keep secure is the back-end.

answered Oct 23, 2012 at 23:03

DanRedux

9,4096 gold badges25 silver badges41 bronze badges

Comments

zmbq · Accepted Answer · 2012-10-23 23:08:54Z

0

Oh, this is the wrong question to ask.

The question you need to ask is "why do I care if someone accesses my server without my client?"

You obviously have a reason. I can think of one reason only - your server trusts the client to behave nicely. Don't do that. Make sure the server can handle any kind of zany client request. It doesn't have to handle it nicely (throwing a 500 Server Error is OK) - as long as rogue clients can't mess with your data or kill your server entirely.

answered Oct 23, 2012 at 23:08

zmbq

39.1k15 gold badges109 silver badges189 bronze badges

Comments

Reflective · Accepted Answer · 2012-10-23 23:13:48Z

0

You could try to obfuscate your javascript code to make it hard readable:

a link to an obfuscator

you can find outhers

If you have authentification, you can pass session id to your API to keep user logged in, so if user is not authentificated he won't be able to get data from your API.

answered Oct 23, 2012 at 23:13

Reflective

3,9371 gold badge17 silver badges25 bronze badges

Collectives™ on Stack Overflow

Securing pure Ajax/Javascript client

5 Answers 5

1 Comment

Comments

Comments

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

5 Answers 5

1 Comment

Comments

Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related