1

I am trying to design a public facing website and would like to experiment with a WebAPI backend and one of the popular front end javascript frameworks. Now, this application is not going to require users to login so there is no authentication process involved.

To be honest most of the rest applications I have developed have been intranet applications so I have not had to worry about scrapping data by others. In the past I have primarily used server side frameworks like ASP.NET/PHP for public facing websites/applications, which would render html output rather than a JSON document.

My current concept in mind involves a javascript, running in the browser requesting my WebAPI endpoint for a JSON document to be returned. Potentially in the future there would also be a mobile application as a client consuming this endpoint.

I obviously cannot provide a shared secret to be stored in the client side to generate a authentication token.
I could think of enforcing CORS headers on the servers to only allow requests from my own domain, but then again nothing stops people from viewing the network activity of this website and getting hold of the endpoint and pinging the endpoint directly from their own client.
I could make use of a short lived access token that my server would hand over only to a valid request from my own website frontend.
But then again nothing stops people from grabbing this token from just refreshing my website and passing on this token to their client.
Also think like host headers, user-agent, etc can be easily spoofed.

I could potentially issue a HTTP cookie to my own domain and each time validate http requests against this cookie. But since I'll also be making ajax calls to the servers my own requests could not be honoured as my scripts also cannot access HTTP only cookies ?.

The best I could do is restrict CORS allow-access setting to my domain name, I do understanding preventing scrapping is a very daunting task, but my view is scrapping a api that returns JSON data would be a much simpler task than say scrapping a HTML output from the server.

Would you recommend the SPA model with a REST api backend for developing such public facing applications that does not require authentication ?

Improve this question
2
  • If security really worry you, take a look here owasp.org.
    – Laiv
    May 7, 2017 at 20:30
  • "but my view is scrapping a api that returns JSON data would be a much simpler task than say scrapping a HTML output from the server." This view is wrong. If you were happy to put data out to the public in the form of HTML you should be equally happy to put it out as JSON. If you aren't happy with this you need to authenticate requests and should have . been doing that on your HTML as well. If you weren't scrapped it is because no one cared to bother, not that it was hard, scrapping HTML is trivial. Moving from HTML to JSON doesn't make your website any more or less secure.
    – Cormac Mulhall
    May 15, 2017 at 16:59

1 Answer 1

Reset to default
3

Your question basically boils down to:

"can I prevent anonymous viewing of my website while also still allowing anonymous viewing of my website"

Well, a capatcha can be used to prevent bots if you have infrequent requests.

But really you have to add a login if you want to restrict access.

Improve this answer
1
  • haha..that oversimplifies the question tbh, may be I am asking can I keep the door open always, but shut it if that person is not me without using a private key ?
    – Vignesh.N
    May 7, 2017 at 12:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.