-1

I have a client that needs to be able to secure a data site from hackers. This is the methodology we currently are looking at:

server.com (web server) —> HTTP JSON API request —> dataStore.net (data server).

He doesn’t want to force people to authenticate just to visit server.com. Authentication would be needed just for accessing dataStore.net. The cross-domain javascript call is possible via CORS, but CORS is not security.

I need to prevent: some-person.com —> HTTP JSON API request —> dataStore.net

Any ideas on how to accomplish this?

  • why can the datastore not simply check if the request comes from a whitelisted IP? if it doesn't, log and deny. – guest Jul 29 '14 at 23:32
  • That means the user has to register, something the client doesn't want them to have to "authenticate" at the web server. – SpokaneDude Jul 30 '14 at 1:21
  • so you want someperson to be able to access datastore only after they've gotten a link from server? I thought you were doing a curl. – guest Jul 30 '14 at 3:43
1

Please bear in mind my answer is based on assumptions. If you edit your question to clarify let me know and I'll update my answer.

From your diagram

server.com (web server) —> HTTP JSON API request —> dataStore.net (data server).

it appears that you are connecting to datastore.net from your server.

However, as you mention CORS, I get the impression that the following diagrams are more accurate:

user —> HTTP request —> server.com

user -> HTTP JSON API request —> datastore.net

?

Authentication would be needed just for accessing dataStore.net.

This statement adds further weight to my assumption.

If this is the case then your authentication needs to take place on datastore.net (not server.com). Only authenticated requests should be allowed to access the data on datastore.net. You also mention that you do not wish for users to register. If you want to protect your data on datastore.net then you must only allow authenticated users to connect, which is why registration is actually neccessary.

The other option is to only allow server.com to communicate with datastore.net (first diagram) - i.e. server side access to the API. This means that datastore.net is effectively a back-end server and does not need to be visible on the internet at all (for inbound traffic other than from server.com).

  • question updated: changed dataStore.com to dataStore.net – SpokaneDude Jul 30 '14 at 16:34
  • @spokane-dude: OK, how about my assumptions? – SilverlightFox Jul 30 '14 at 16:36
  • They are correct... the user makes a request from server.com which in turn makes a JSON API request to dataStore.net. – SpokaneDude Jul 30 '14 at 17:46
  • @spokane-dude: I think you should take your datastore.net API off the internet and simply have a direct back-end connection to it from server.com. – SilverlightFox Jul 30 '14 at 21:36
2

I need to prevent: some-person.com —> HTTP JSON API request —> dataStore.net

It is important to understand, that if anyone wants to get data from your data store they could just use any web proxy to circumvent cross origin policies.

It is unclear what you are asking here, but I would recommend to take dataStore.net off the internet, put it in a private network and let server.com back-end talk to it through internal network. Alternatively if it needs to be on the internet you could let server.com back-end to authenticate and deny any other requests.

This way users can still user server.com without registering, but your data store will be protected.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.