1

Does anybody know of a way of checking on the API side if a XMLHttpRequest has been made from my own web-application (ie. from the JS I have written) or from a third-party application...

The problem, to me, seems to be that because the JS is run on the client and thus accessible to anyone I have no way of secretly communicating to the API server who I am. I think this is useful because otherwise I cannot prioritize requests from my own application over third-party clients in case of high usage.

I could obviously send some non-documented parameters but these can be spoofed.

Anybody with some ideas?

3 Answers 3

2

I would have your web server application generate a token that it would pass to your clients either in JavaScript or a hidden field which they in turn would use to call your API. Those with valid tokens get priority, missing or invalid tokes wouldn't. The web server application can create & register the token in your system in a way that limits its usefulness to others trying to reuse it (e.g., time limited).

3
  • Very good idea. I didn't think of that. I mean it could still be stolen but because of the time sensitivity it would make it less useful from "thiefs". Although, just playing devil's advocate here, they could obviously themselves run a program that steals the code every x minutes (by pretending to be a client) and then insert into their own code. But life aint perfect :-p. Thanks!
    – o1iver
    Jan 23, 2011 at 11:29
  • Actually I could kind of avoid that by building a token based on some secret on the front-end http server + the client's IP address. This means that I could check, that the token has really been produced recently AND for the client making the request!!
    – o1iver
    Jan 23, 2011 at 11:31
  • In addition to time sensitivity, you could consider things like browser user agent and part of the IP address (maybe just the class B part). Remember, users behind large proxy servers (e.g., corporate) may present different IP addresses between requests. Jan 23, 2011 at 16:48
2

If you do approve of third party clients accessing your API, perhaps you could provide them with a slightly different, rate-limited interface and document it well (so that it would be easier to use and thus actually be used by third-party clients).

One way to do this would be to have two different API URLs, for example:

  • /api?client=ThirdPartyAppName&... for third-party apps (you would encourage use of this URL)
  • /api?token=<number generated from hidden fields from the HTML page using obfuscated code>&... for your own JS

Note that as you mention, it is not possible to put a complete stop to reverse engineering of your own code. Although it can take longer, even compiled, binary code written in such languages as C++ can be reverse engineered, and that threatens any approach relying on secrecy.

3
  • Good points, although like you say it is not entirely safe. Thus I must say that I like ongle's idea of sending time limited or something tokens from the http server every time. These could then not be stolen by a third-party client if the time limit is something like 2 hrs...
    – o1iver
    Jan 23, 2011 at 11:27
  • @ol1ver: "time limited" tokens -- that was my intent. Jan 23, 2011 at 15:54
  • well thanks. I hate the fact that I cant approve two answers on SO...:-p
    – o1iver
    Jan 23, 2011 at 17:06
0

A couple of ideas come to mind. I understand that secrets never last, so I agree that's not a good option.

  • You could run another instance on a different unadvertised port

  • You could do it over SSL and use certs to identify the client

  • A simple but less secure way would be to use cookies

  • You could go by IP address, but that could be an administrative nightmare

1
  • The problem with 1, 2 and 4 is that I don't know who the client is and I cannot hide the connection details (as they are in the JS)...
    – o1iver
    Jan 23, 2011 at 11:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.