3

With the ArcGIS Server JavaScript API, you can find the URLs in the map services in the source code. Do the Flex and Silverlight APIs completely obfuscate the map services URLs?

As an example, the County of Ventura has this web application in Flex. However, there doesn't seem to be a way to find the rest services URLs for the map services that one could use in their own applications/mashups. Perhaps obfuscation is the point to using a compiled web application vs the JavaScript API?

Improve this question
1
  • The comment below is good unless they have a Proxy server setup which will shield the Rest endpoints.
    – D.E.Wright
    Commented Jun 28, 2011 at 5:27

1 Answer 1

Reset to default
4

I used Fiddler and now I know the service that you added is from: http://gis.ventura.org/ArcGIS/rest/services/MSDs/Basemap/MapServer

enter image description here

There are a few other tools like Fiddler that captures HTTP traffic (request and responses from client to server) and logs it for the user to review. If you really need to hide your url's, use the HTTPS protocol. Using HTTPS will only allow the client to know which server the request is issued to and not what the request is.

Improve this answer
5
  • Good thought, unless the server is secured behind a proxy in which case you will only see the external face. But it is a very good starting point to look to.
    – D.E.Wright
    Commented Jun 28, 2011 at 5:28
  • Correct me if I'm wrong, but I think implementing reverse proxy will only provide pseudo URLs for the original one. This means that you'll hide the original ArcGIS Server machine name, but you can still access the service via those captured pseudo URLs in another client.
    – Thomas
    Commented Jun 28, 2011 at 5:35
  • Unless you implmenet a Token between the Proxy and Internal server, this would lock you to accessing the proxy to get to the source; the proxy knows what the true URL is. This way the Proxy masks what you are accesing. Maybe I am wrong; but this is always the way I saw the reverse proxy / token pair working.
    – D.E.Wright
    Commented Jun 28, 2011 at 5:40
  • 1
    You don't need token based authentication when implementing reverse proxy albeit these two are often done together. But implementing a token requires mandatory use of HTTPS; which brings the discussion back to the above answer. Infinite loop :).
    – Thomas
    Commented Jun 28, 2011 at 5:44
  • Very true; I guess I think totally secure; not just masked. Fiddler is a wonderful tool for free.
    – D.E.Wright
    Commented Jun 28, 2011 at 5:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.