While users using my application, they can view resource from browser and see my arcgis rest service URLs. So If I use token based security, security token can view. Can I hide this from users?
Add a comment
|
1 Answer
I don't know ArcGIS very well, a possible solution is using an http proxy: your client sends the requests to a proxy which add the token in the url. With this solution, the clients doesn't know about the token
client --> (/rest/resource) --> | PROXY | --> (/rest/resource?token=xxx) --> arcgis
Some documentation can be found
Another solution (easier, but I don't know if is supported by arcgis) is put the token not in the url but in the header or as a cookie. It won't be visible in the url anymore, it's easier, but it could be seen using any of the developer tools that are shipped with almost all browser...
