Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In one website I had to manually enter first hand data, which is a really tiresome job. I am concerned if I return such data in json, it would be too easy to parse and incorporate into other's database, render my previous effort futile.

In this case would it be justifiable for me to return the said data in html code, e.g. in table form? Or what else can I do to secure the json so that it is more difficult for third party to parse it structurally?

share|improve this question

This question is the Web 2.0 equivalent to "How do I disable right-click to stop people from stealing my HTML?"

The answer is that if you want people to be able to use your site, (on in this case, your data) you can't.

If your data is really so valuable that people want it badly, put it behind a paywall, charge a subscription to access it, and use a contract to set rules around how it can be used. If you detect your paying users scraping the data against your terms of service, you can then deal with it civilly via the court system.

However, if the data isn't valuable enough for people to pay to use, then the hard truth is that it's probably not valuable enough to scrape and steal either, in which case, don't worry about it.

share|improve this answer

Returning a HTML table will not prevent parsing. Actually nothing will prevent parsing, not even encoding your data as pictures rendered in a Flash viewer. But an HTML table is a piece of cake. Even Excel can understand a HTML table !

For your problem of how tiresome entering the data was, I'd say: well, suck it up. When you publish data, you cannot enforce technical constraints on how other people will use it; at best you can have some partial deterrents which will prune out the least motivated attackers. If there was a better solution, there would be no music/video/game piracy ! The only realistic protection measures against unwanted extraction of data are legal, not technical. Ask a lawyer what "copyright" means and what he can do to smite intellectual property trespassers.

share|improve this answer
+1; also ask your local lawyer about "database rights": "A database right is considered to be a property right, comparable to but distinct from copyright, that exists to recognise the investment that is made in compiling a database..." (YMMV by national jurisdiction.) – apsillers Jul 18 '13 at 20:45

An HTML table is just as easy to parse as json. There are obfuscation tools available however the bottom line is if the person can see it they can scrape it and put it in a database. The only know way to prevent copy cats is to not do it at all.

share|improve this answer

You could make scraping more time consuming if you return only a small subset of your database for each user request, and you force the user to complete a captcha with every request.

This would mean the person who wants to scrape your data will need to complete many captchas to get your whole database.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.