Geographic Information Systems Stack Exchange is a question and answer site for cartographers, geographers and GIS professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

While users using my application, they can view resource from browser and see my arcgis rest service URLs. So If I use token based security, security token can view. Can I hide this from users?

share|improve this question

I don't know ArcGIS very well, a possible solution is using an http proxy: your client sends the requests to a proxy which add the token in the url. With this solution, the clients doesn't know about the token

client --> (/rest/resource) --> | PROXY | --> (/rest/resource?token=xxx) --> arcgis

Some documentation can be found

Another solution (easier, but I don't know if is supported by arcgis) is put the token not in the url but in the header or as a cookie. It won't be visible in the url anymore, it's easier, but it could be seen using any of the developer tools that are shipped with almost all browser...

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.