I want to implement a telemetry data sender into my electron app. The API which I want to connect to is public. So any crash reports or any other data from the user is sent to it. The problem is how do I secure the API to prevent spam reports?

For example VS Code is collecting telemetry data from the user and it's sending those data to a collecting REST API. How does Microsoft prevent spam reports?

The structure is the following

Electron App -> User Data -> (How to prevent spam?) API Server -> Database


  • It would appear that a form of authentication is the standard control. – schroeder Jul 10 at 15:59
  • But how does a form authentication works in a software which is public to everyone. Look at vscode's telemetry data sending. I can't find any type of code in the code base of vscode that will generate an fixed ID for the user. So Microsoft ist handling the post request for there API in a way that they can validate them to prevent spam reports. – S Nell Jul 10 at 18:52
  • Don't think in terms of that kind of authentication. You don't need to authenticate the specific user or node, but rather you need to authenticate the submission. – schroeder Jul 10 at 18:54
  • Ah I see, you mean to specify the form of sending? Maybe some sort of generated hash, which the server can validate? – S Nell Jul 10 at 18:56
  • That's the sort of thing. Digital Signing, HMAC, shared secrets, etc. – schroeder Jul 10 at 18:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.