I’m building an application which subscribes to a Javascript event, and sends out a mail when the event is fired.
At present I’m using a callbacks controller, which then sends the mail via a mailer. The controller is accessed via an ajax call to the relevant url.
My problem is that I do not want to expose this url for obvious reasons. Is there a way of making the callback without exposing it as a public url?
In short, no.
If you want the server to know when something happens on the client, then the client has to be able to communicate that to the server.
The nature of the web means that you cannot ask a client to keep a secret from its user, so anything the client can do can also be done manually by the user.