My company offers a Javascript plugin that is meant to be embedded with websites. It works in a similar fashion to Google Analytics, in which you add a bit of Javascript and then it does some magic on the website. Contrary to Google Analytics, this plugin will have some visible side-effects for the end-user. These are expected.

The JS plugin itself writes data back regularly to our servers but, same as Google Analytics, we do not hold authentication data for the end-users that will use our plugin. So, how can we secure user input in this situation?

Updating definition of secure

I want to minimize the amount of unwanted data our users can send to our system.

  • Please define what you mean by "secure". are you talking about access control, data validation, confidentiality ?
    – Stephane
    Commented Apr 28, 2014 at 10:00
  • 2
    You can't control what users send to your system, you can control how you handle it.
    – ndrix
    Commented Apr 28, 2014 at 13:07

1 Answer 1


Just as @m1ke stated, "You can't control what users send to your system, you can control how you handle it." Javascript runs directly in the browser and can be seen by anyone (as can the network calls), therefore you can't really control what they send you. Otherwise, I recommend viewing Google Analytics' Security Policy. Aside from this simply follow general Javascript best practices as documented in the following links:

lastly, in terms of "minimize the amount of unwanted data" I also suggest investigating rate limiting. Essentially this may restrict an overabundance of requests and may reduce the "garbage". Twitter's example and Github's example.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .