Question

We are creating an online service divided like that:
– an API, of course
– full JS/AJAX client, no MVC, it is pure JS

We are experienced developers and we do know that we can’t secure the JS client code, however, we are trying to figure way to prevent 3rd parties from creating their own client by analyzing our JS API Call and this way restrict access only from our own client.

Thanks in advance!

Answer 1

We are experienced developers and we do know that we can’t secure the
JS client code, however, we are trying to figure way to prevent 3rd
parties from creating their own client by analyzing our JS API Call
and this way only restreint access from our own client.

That is contradiction in terms. If you know that client-side ECMAscript code can never be hidden, it will always be possible for any somewhat experienced developer to analyse your code. Even if heavily obfuscated, minified and uglified.

Use a server-side authentication, by password. Its the only secure way. You just can not prevent that somebody will clone/copy your script.