Let's say we're running Google Analytics, and we're tracking user specific data (or displaying contents based on that data, such as most recently viewed pages) -- we add a pixel, and then we pass the user data to the Analytics platform. What's to prevent a malicious user from passing a bunch of garbage data based on random user ids?

Same thing with mobile; let's say we integrate a customer service SDK such as Zendesk. There's usually either a key or a cert that we have to include in our apps. What's to stop a malicious user from decompiling our app and then using the provided cert in the app, read all user tickets from whatever user id he passes?

And what are things we can do, both as app/web developers and SDK developers to block these types of attacks?

1 Answer 1


I don't know of any protection mechanism and I have never seen anything in existing web apps. This is kind of an inherent problem of your client sending requests directly to the third party. In this case a tracking/analytics service.

You can try to obfuscate the JavaScript which creates the request but platforms such as Google have a clearly documented API.

There is even a blog post on how to corrupt this data by using the account on another website which also uses Google analytics.

You can try to track users serve side. Certainly when they have been authenticated, you can track the session across requests. But this does not give you as detailed info as you would get with some JavaScript features. Unauthenticated users could keep requesting new sessions and you wouldn't know.

You will never be able to tell with a 100% certainty if your data has been generated by a bot. Someone can also crawl your website or use a tool like selenium to automate certain user behavior. Some metrics like user agent, timing and HTTP headers could help identify these automated visits.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .