While users using my application, they can view resource from browser and see my arcgis rest service URLs. So If I use token based security, security token can view. Can I hide this from users?


I don't know ArcGIS very well, a possible solution is using an http proxy: your client sends the requests to a proxy which add the token in the url. With this solution, the clients doesn't know about the token

client --> (/rest/resource) --> | PROXY | --> (/rest/resource?token=xxx) --> arcgis

Some documentation can be found

Another solution (easier, but I don't know if is supported by arcgis) is put the token not in the url but in the header or as a cookie. It won't be visible in the url anymore, it's easier, but it could be seen using any of the developer tools that are shipped with almost all browser...

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.