Tag Info

New answers tagged

0

If your credentials are going out with your JavaScript, they can't be kept secret. However, if your credentials are stored on the server, you can keep them secret, by having a server side function use them. In this way, you can examine the incoming request from JS using your server side function, and determine if it's legitimate. If it is legit, you can ...


1

What stops any user to change query string to userid=2000&itemid=55555&itemvalue=100 Nothing. As such you should not make this secure call to the 3rd party from the client app. It should instead be made via your server, as that is the only place you can secure the sensitive authentication information for the 3rd party app. So the client app ...


0

Why should I do it? So we create a form, and we'll have an endpoint where that data can get submitted. Which means anyone can submit data there and see what happens. So we need to validate on two things: that it's being submitted by a user (which .NET will handle for us), and that they're submitting data via a requested form and not just willy-nilly ...


3

I need for my app to consume a rest api service and since I will call it from javascript/jquery i need to expose it to the end user That's your first mistake. As Pinoniq pointed out in his answer, it's not possible to secure client side code. However, you can add your own server to the mix. Have your client side code use JavaScript / jQuery to make a ...


0

I think you should not directly access the Third Party API from your JavaScript application. Instead, you should implement your own basic web services which is like a wrapper around the Third Party API. You can then implement your own authentication method inside your own small web service or do not implement it in case it is not needed. However, you could ...


7

You can't. Let me rephrase: Impossible You could/should make it harder to use a token. Implementing a max-usage per token, a max life-time, ... It is however impossible to know if it is the scriptkiddie or your 'application' contacting your api. A lot of people tend to forget that it is never the aplpication calling the api, it's the application, ...



Top 50 recent answers are included