Let say you have a Website with advertising, and each time a user clicks on it, you want to charge an advertiser the amount he bids (basically, a pay-per-click system, like Adswords, with a different cost for every click).

Now, when the user clicks on an ads, you can't just call an API from the frontend and send the ID of the advertiser and how much he has to pay (which vary for each user), or it would be too easy for malicious user to charge an advertiser for nothing.

I was thinking about creating a token each time I show an advertisement, log that token in the database, and log it again if the user clicks on the ads. But I'm worry this might still have security flaws. Do you know what's the best way to solve such a problem?

  • 1
    Having something server-side to compare against is really the only thing you can do in principle, so you're on the right track. I found security.stackexchange.com/questions/20675/… over on security.SE which lists additional things worth trying. – Ixrec Apr 16 '15 at 19:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.