0

I'm struggling to understand how one can secure an API endpoint using JavaScript.

I want to create a copy and paste-able snippet of Javascript that a user can paste in their site. And on page load/s data will be fed back to the application via and API call.

I understand you could have a token behind server side code etc. But I ideally want this to be really easy to use - a simply copy and paste Javascript tracking code snippet.

I also know I can apply throttling and whitelist IP's, Hostsnames and numbers of request within a timeframe. But this is not 100% secure as someone could still spoof this?

How do companies like Google do this? E.g with their Maps API you can whitelist URLS, IPs etc. Is this 100% secure?

Many applications have copy and paste-able Javascipt code that you add to your site that feds data back to the app. E.g. HubSpot etc.

How are they doing this without their API's getting spammed to death? What am I missing here?

(*As a note I'm using Django Rest Framework)

Improve this question
3
  • They use rate limiting, client side user interaction detection systems like Google Analytics, reCAPTCHA v3 and similar techniques.
    – Sir Muffington
    Nov 12 at 18:00
  • 1
    "But this is not 100% secure" - nothing is 100% secure. There is always a trade-off between achievable security, usability, costs, .... You need to match what you need to achieve and what you are willing to spend against your actual threats - which depend on what you protect. A generic "API" does not provide relevant information about what costs are acceptable to mitigate what kind of threats.
    – Steffen Ullrich
    Nov 12 at 18:02
  • "How do companies like Google do this?" - the infrastructure they have and the knowledge, efforts and money they can invest in mitigations outweighs the capabilities of normal attackers. You cannot stem this kind of investment by your own, but you can use powerful front services like Cloudflare to protect your API against several common attacks.
    – Steffen Ullrich
    Nov 12 at 18:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.