Question

I have an API (1) on which I have build an web application with its own AJAX API (2). The reason for this is not to expose the source API.
However, the web application uses AJAX (through JQuery) go get new data from its AJAX API, the data retrieved is currently in XML.
Lately I have secured the main API (1) with an authorization algorithm. However, I would like to secure the web application as well so it cannot be parsed. Currently it is being parsed to get the hash used to call the AJAX API, which returns XML.

My question: How can I improve the security and decrease the possibility of others able to parse my web application.
The only ideas I have are: stop sending XML, but send HTML instead. Use flash (yet, this is not an option).

I understand that since the site is public, and no login can be implemented, it can be hard to refuse access to bots (non legitimate users). Also, Flash is not an option… it never is 😉

edit
The Web Application I am referring to: https://bikemap.appified.net/

Answer 1

This is somewhat of an odd request; you wish to lock down a system that your own web application depends on to work. This is almost always a recipe for disaster.

Web applications should always expect to be sidelined, so the real security must come from the server; tarpitting, session tokens, throttling, etc.

If that’s already in place, I don’t see any reason why should jump through hoops in your own web application to give robots a tougher time … unless you really want to separate humans from robots 😉

One way to reduce the refactoring pain on your side is to wrap the $.ajax function in a piece of code that could sign the outgoing requests (or somehow add fields to it) … then minify / obscurify that code and hope it won’t get decoded so fast.