Hi i am working with JSON. I want to protect my JSON . I am getting JSON on the User Interface side by a service call using a Jquery. Is there some mechanism by which the JSON which i am returning from my service is encrypted JSON and when i am receiving that JSON using JQuery i can decrypt it. But at the time of decryption i dont want to expose the Key or certificate for decryption to the Frontend. How can i protect my JSON.
closed as unclear what you're asking by Eric G, TildalWave, Xander, Gilles, AJ Henderson Apr 9 '14 at 13:44
Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.
Some answers mention here SSL/TLS. SSL/TLS is used to encrypt the whole data between two communicating parties, typically client and server (also called point-to-point encryption). This standard however does not always cover all the security needs, e.g.:
- if the user wants to encrypt only part of his data.
- if the user wants to transfer his data over several machines (web services) and does not want the machines see the data, he needs end-to-end security. (In case of TLS, each intermediary machine can decrypt the data, see the content, encrypt it again and forward it to further machine.)
- if the user wants to store the data encrypted on the server, which receives it.
You did not describe your scenario very well, but I assume you would like to encrypt your json data because of one the above points. If this is the case, you can use the newly standardized JSON Web Encryption Standard (http://tools.ietf.org/html/draft-ietf-jose-json-web-encryption), which gives you possibilities to encrypt json data. Even though it is still a draft, there are already some implementations. If you are implementing a Web site, you can take a look at Web Crypto API (http://www.w3.org/TR/WebCryptoAPI/).
Set up TLS and access the webservice which exposes the JSON data through
https. You will need to get a certificate signed by a certificate authority, but besides that it's an easy, reliable and proven way to set up encryption for any kind of web application.
While you to decrypt in client side jquery, It's very difficult you to hide your key.Try SSL on or do decryption in server side.