Question

I’m trying to make a bookmarklet that does something similar to what Instapaper’s does. I need the bookmarklet to send the URL of the page the user is visiting and the user’s token(so the server identifies the user). How can this be done? Do you recommend I send a POST request or rather by routing the URL(for eg http://example.com/USER_TOKEN/URL )?

Also, will I need to worry about the user’s token being stolen? If so, how can I handle that?

Answer 1

will I need to worry about the user’s token being stolen

Since everything you transmit over plain HTTP is basically unencrypted plain-text, yes, you need to worry about the token being stolen.

What’s more important imo, is that including the user token into your bookmarklet seems rather hack-ish:

1. What if a machine is used by multiple users A, B and C?
2. Users A and B are both using your service? Separate bookmarklets?
3. User C is pissed off about something A did – clicking his bookmarklet on a dozen porn sites sure sounds like fun, eh?

I would suggest something along the following lines:

• Submit the URL to a GET (if you care about performance much) or POST (if you care about getting CRUD right) route.
• Server-Side: Check if a user session exists (via cookies, obviously).
  • If so, process your data, send success callback as JSONP.
  • If not, send failure callback as JSONP which triggers a “Please Log in” popup/overlay.

Extra points are given for the “Please log in” thingy remembering the URL the user has been trying to save so he doesn’t have to re-submit after having logged in.