I am making a Google Analytics like service where you embed generated code into your website and it tracks certain data. I have a backend REST api, but I am not sure how to securely implement a call to it in the frontend without all the authentication data being exposed. I am worried that if a user embeds this code into their website with authentication, such as a session ID or a user ID, anybody would be able to just take that data and make a call to the api before the session times out and mess with the user's data. Is there any way to prevent this risk and safely design the backend api and the call so that it is much more difficult or impossible for people to make calls to a user's private api?

  • In short, no, but this is why you write code secure against XSS, enable HTTPS, and use session tokens instead of raw login credentials to authenticate with. If your client is compromised, the attacker can do anything the client can, so you protect the client from being compromised.
    – anon
    Jul 11, 2019 at 19:43
  • Just to be clear, when you say "user" are you talking about a consumer of your web service who is putting your front-end code on a site they own, or do you mean an end-user who is viewing such sites with their browser? Depending on the design and the objectives, the security situation is going to be pretty different. (Also, obligatory comment: you cannot make anything that is designed to track people and cannot be spoofed, tampered with, or blocked. Your data will always have error.)
    – CBHacking
    Jul 12, 2019 at 1:32

1 Answer 1


You can have something like a JWT token, where the user (front-end) will know, but can't read it. Then, for each request you send the JWT token and your back-end will know how to decrypt and validate if the user can perform or not this action.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .