Geographic Information Systems Stack Exchange is a question and answer site for cartographers, geographers and GIS professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

With the ArcGIS Server JavaScript API, you can find the URLs in the map services in the source code. Do the Flex and Silverlight APIs completely obfuscate the map services URLs?

As an example, the County of Ventura has this web application in Flex. However, there doesn't seem to be a way to find the rest services URLs for the map services that one could use in their own applications/mashups. Perhaps obfuscation is the point to using a compiled web application vs the JavaScript API?

share|improve this question
The comment below is good unless they have a Proxy server setup which will shield the Rest endpoints. – D.E.Wright Jun 28 '11 at 5:27
Thanks. That's exactly what I needed to know. – npeihl Jun 28 '11 at 20:23
up vote 4 down vote accepted

I used Fiddler and now I know the service that you added is from:

enter image description here

There are a few other tools like Fiddler that captures HTTP traffic (request and responses from client to server) and logs it for the user to review. If you really need to hide your url's, use the HTTPS protocol. Using HTTPS will only allow the client to know which server the request is issued to and not what the request is.

share|improve this answer
Good thought, unless the server is secured behind a proxy in which case you will only see the external face. But it is a very good starting point to look to. – D.E.Wright Jun 28 '11 at 5:28
Correct me if I'm wrong, but I think implementing reverse proxy will only provide pseudo URLs for the original one. This means that you'll hide the original ArcGIS Server machine name, but you can still access the service via those captured pseudo URLs in another client. – Thomas Jun 28 '11 at 5:35
Unless you implmenet a Token between the Proxy and Internal server, this would lock you to accessing the proxy to get to the source; the proxy knows what the true URL is. This way the Proxy masks what you are accesing. Maybe I am wrong; but this is always the way I saw the reverse proxy / token pair working. – D.E.Wright Jun 28 '11 at 5:40
You don't need token based authentication when implementing reverse proxy albeit these two are often done together. But implementing a token requires mandatory use of HTTPS; which brings the discussion back to the above answer. Infinite loop :). – Thomas Jun 28 '11 at 5:44
Very true; I guess I think totally secure; not just masked. Fiddler is a wonderful tool for free. – D.E.Wright Jun 28 '11 at 5:47

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.