Question

Ok, so this is maybe a very basic question about REST concepts or Rails security in general, but bear with me.

I have a google map in my main page, I would like to get all the latitudes/longitudes from the companies in my DB so I can create the markers and show them.

So, I created a resource that’s http://mywebsite.com/companies/locations, it returns a json object with the company ids and each of their latitude longitudes.

Now, this is probably the right way to do it, but I keep getting this feeling that its a bit too… exposed?

I mean, anyone could just type that on the browser and get all the companies we have. That doesn’t sound very secure.

In my mind there would be a way for only that javascript ajax call to get the information and “hide” it from the public eye, or is this just a case of security through obscurity?

Is there a common piece of knowledge I’m missing or something?

Thanks.

Answer 1

Any data that needs to be sent to the client browser (i.e. anything to be used by JavaScript) is vulnerable. There is no way to reliably protect such data.