0

I am using ajax in my website and in order to use the ajax, I habe to write the name of the file for example:

id = "123";
$.getJSON(jquerygetevent.php?id=" + id, function(json)
{
    //do something
});

how can I protect the url? I dont want people to see it and use it...

Improve this question

5 Answers 5

Reset to default
5

that is a limitation of using client side scripts.
there is no real way to obfuscate it from the user
there are many ways to make it less readable (minify etc) but in the end an end-user can still view the code

Improve this answer
Sign up to request clarification or add additional context in comments.

2 Comments

Few users will be looking at your HTML/CSS/Javascript source anyway.
Even if you used layers of obfuscation, it would still be trivial to see the real URL by watching a tool like Firebug or LiveHTTPHeaders.
2

Hi Ron and welcome to the internet. The internet was (to quote Wikipedia on the subject)

The origins of the Internet reach back to research of the 1960s, commissioned by the United States government in collaboration with private commercial interests to build robust, fault-tolerant, and distributed computer networks. The funding of a new U.S. backbone by the National Science Foundation in the 1980s, as well as private funding for other commercial backbones, led to worldwide participation in the development of new networking technologies, and the merger of many networks. The commercialization of what was by the 1990s an international network resulted in its popularization and incorporation into virtually every aspect of modern human life.

Because of these origins, and because of the way that the protocols surrounding HTTP resource identification (like for URLs) there's not really any way to prevent this. Had the internet been developed as a commercial venture initially (think AOL) then they might have been able to get away with preventing the browser from showing the new URL to the user.

So long as people can "view source" they can see the URLs in the page that you're referring them to visit. The best you can do is to obfuscate the links using javascript, but at best that's merely an annoyance. What can be decoded for the user can be decoded for a bot.

Welcome to the internet, may your stay be a long one!

Improve this answer

Comments

0

I think the underlying issue is why you want to hide the URL. As everyone has noted, there is no way to solve the actual resolved URL. Once it is triggered, FireBug gives you everything you need to know.

However, is the purpose to prevent a user from re-using the URL? Perhaps you can generate one-time, session-relative URLs that can only be used in the given HTTP Session. If you cut/paste this URL to someone else, they would be unable to use it. You could also set it to expire if they tried to Refresh. This is done all the time.

Is the purpose to prevent the user from hacking your URL by providing a different query parameter? Well, you should be handling that on the server side anyways, checking if the user is authorized. Even before activating the link, the user can use a tool like FireBug to edit your client side code as much as they want. I've done this several times to live sites when they're not functioning the way I want :)

UPDATE: A HORRIBLE hack would be to drop an invisible Java Applet on the page. They can also trigger requests and interact with Javascript. Any logic could be included in the Applet code, which would be invisible to the user. This, however, introduces additional browser compatibility issues, etc, but can be done. I'm not sure if this would show up in Firebug. A user could still monitor outgoing traffic, but it might be less obvious. It would be better to make your server side more robust.

Improve this answer

3 Comments

Yes. the purpose is to prevent from re-using the url or from using it outside the specific page. after I read some comments here I understood there's no reason to do it, so I give up..
I think the best you can do in that case is to set up the URL to ignore calls under certain conditions. For example, only one call per user, minute, page. In the end, a request is a request and it will be difficult to identify whether your script triggered it or not. You could add some funky computed parameters, but it can all be worked out eventually.
For the very same reason that eventually it can all be worked out, I prefer to give up and instead I will make wiki so people will be able to use the file ~it return json object~ and therefore more people will like it.
0

Why not put some form of security on your php script instead, check a session variable or something like that?

EDIT is response to comment:

I think you've maybe got the cart before the horse somehow. URLs are by nature public addresses for resources. If the resource shouldn't be publicly consumable except in specific instances (i.e. from within your page) then it's a question of defining and implementing security for the resource. In your case, if you only want the resource called once, then why not place a single use access key into the calling page? Then the resource will only be delivered when the page is refreshed. I'm unsure as to why you'd want to do this though, does the resource expose sensitive information? Is it perhaps very heavy on the server to run the script? And if the resource should only be used to render the page once, rather than update it once it's rendered, would it perhaps be better to implement it serverside?

Improve this answer

1 Comment

This is a good solution but still they can use the ajax from the same page many times instead of outside the page. Yeah I can make interval but I prefer not to and I give up.
0

you can protect (hide) anything on client, just encrypt/encode it into complicated format to real human

Improve this answer

Comments

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.