Skip to main content
Information Security

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

Required fields*

4
  • Yeah Ultimately you have just reiterated what I already knew. Use Case is this: We have a geolocation server (i.e. give it an address, returns the long/lat). This is a server we have installed and maintain. We don't want abuse of this server, and it is really only intended for use by our apps (web and other). The question is how do we ensure (or at least minimise) vetted use Commented Sep 13, 2016 at 22:08
  • @OJay - "how do we ensure (or at least minimise) vetted use" - authentication+authorization, if you do not want the entire internet to see a page (or a rest api) you need to authenticate the users who can see it. And simply not send it to the users that do not authenticate correctly. Commented Sep 13, 2016 at 22:17
  • @OJay: Pretty much can't be done, especially if you do want it to be accessible to a browser. You could embed an authentication token or cryptographic key in an actual app and try some silly obfuscation tricks to make reverse engineering harder, but at the end of the day somebody can work out how to spoof that authentication and use it themselves. In a browser you don't even have that option (I mean, you could do even sillier tricks with obfuscated JS, but JS reverse engineering is child's play). Commented Sep 13, 2016 at 22:27
  • You can try things like restricting the service to certain IP addresses, if your clients are going to be using fixed IPs and nothing at that IP can be used as a proxy... Commented Sep 13, 2016 at 22:29