8

I am reading the authenticated services with token. I understand that a user have to get a token to using arcgis services. Example: https://domain.com/arcgis/rest/services/myMap/MapServer is my service. My server administrator give me a token like this. Token = AJSJK876548sjjs7

And I used this service in my javascript api like this https://domain.com/arcgis/rest/services/myMap/MapServer?token=AJSJK876548sjjs7

A user can view my application source from browser and can get my token. And He/She can access my service. Is this a security problem?

Improve this question

1 Answer 1

Reset to default
8

Yes, it is a security problem.

A common solution is to go through a proxy- a service you write that your client can call that will in turn call the endpoint. Your client calls your service with all arguments except the token. The service copies all the arguments passed to it, adds the token, calls the endpoint, and returns the response to your client.

Improve this answer
2
  • 2
    It's important to note that with this approach the onus is then on the developer to somehow secure the proxy. After all, the user can now simply pretend to be the application and ask the proxy to return information indirectly from the underlying service. At the end of the day your security has to take into account that an authorized user will ultimately have access to the raw data. If you need to limit the data an authorized user can access, you should add logic to do so in the proxy.
    – Philip
    Commented Jun 19, 2013 at 0:27
  • Good point, Phillip.
    – Russell at ISC
    Commented Jun 19, 2013 at 13:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.