My company offers a Javascript plugin that is meant to be embedded with websites. It works in a similar fashion to Google Analytics, in which you add a bit of Javascript and then it does some magic on the website. Contrary to Google Analytics, this plugin will have some visible side-effects for the end-user. These are expected.

The JS plugin itself writes data back regularly to our servers but, same as Google Analytics, we do not hold authentication data for the end-users that will use our plugin. So, how can we secure user input in this situation?

Updating definition of secure

I want to minimize the amount of unwanted data our users can send to our system.

  • Please define what you mean by "secure". are you talking about access control, data validation, confidentiality ? – Stephane Apr 28 '14 at 10:00
  • 2
    You can't control what users send to your system, you can control how you handle it. – ndrix Apr 28 '14 at 13:07

Just as @m1ke stated, "You can't control what users send to your system, you can control how you handle it." Javascript runs directly in the browser and can be seen by anyone (as can the network calls), therefore you can't really control what they send you. Otherwise, I recommend viewing Google Analytics' Security Policy. Aside from this simply follow general Javascript best practices as documented in the following links:

lastly, in terms of "minimize the amount of unwanted data" I also suggest investigating rate limiting. Essentially this may restrict an overabundance of requests and may reduce the "garbage". Twitter's example and Github's example.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.