Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

My company offers a Javascript plugin that is meant to be embedded with websites. It works in a similar fashion to Google Analytics, in which you add a bit of Javascript and then it does some magic on the website. Contrary to Google Analytics, this plugin will have some visible side-effects for the end-user. These are expected.

The JS plugin itself writes data back regularly to our servers but, same as Google Analytics, we do not hold authentication data for the end-users that will use our plugin. So, how can we secure user input in this situation?

Updating definition of secure

I want to minimize the amount of unwanted data our users can send to our system.

share|improve this question
    
Please define what you mean by "secure". are you talking about access control, data validation, confidentiality ? –  Stephane Apr 28 at 10:00
2  
You can't control what users send to your system, you can control how you handle it. –  m1ke Apr 28 at 13:07

1 Answer 1

up vote 2 down vote accepted

Just as @m1ke stated, "You can't control what users send to your system, you can control how you handle it." Javascript runs directly in the browser and can be seen by anyone (as can the network calls), therefore you can't really control what they send you. Otherwise, I recommend viewing Google Analytics' Security Policy. Aside from this simply follow general Javascript best practices as documented in the following links:

lastly, in terms of "minimize the amount of unwanted data" I also suggest investigating rate limiting. Essentially this may restrict an overabundance of requests and may reduce the "garbage". Twitter's example and Github's example.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.