Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have an API and a web application where users can login through another system and then post text messages to my application, for example.

How can I assure that when this data is only posted to my application, and not sent to other websites?

share|improve this question
Fel - do you mean you want to find some way that the user knows they are only connecting to you? Or are you looking for a way to prevent copying of data to another site? Or something else? Can you clarify please - that will help people answer. – Rory Alsop Oct 9 '12 at 14:37
@RoryAlsop Yes, my idea is just ensure that the users are only connected to me. – Fel Oct 9 '12 at 14:45
okay - I have updated the question to reflect this. – Rory Alsop Oct 9 '12 at 14:53
up vote 2 down vote accepted

If I read the question correctly, long story short is that you can't.

Data is being input into a system under someone else's control. Any measure you take to ensure the data is sent to you can be circumvented by the other party.

share|improve this answer

Can you give some more information about what you are trying to prevent? The situation still doesn't seem very clear. It sounds like you have some backend API and a front end application that uses the API. In addition, you want to be able to do a login from some other system.

If you want to make sure data from your application can only be sent to your API, then you need to either have the application expose a callback for the login and then have the application relay this information to your API or, alternately, you could provide an authentication API that the login could use. In this case, your Application would need to produce an authentication challenge associated with its current activity, that challenge would then be sent to the login service to be verified. When the login service provides authentication back to the API, it would be able to call back to your Application and allow the transaction to occur between your application and your API.

I'm not sure if this helps since the question is hard to understand. I can update my answer if you can provide more details.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.