A web application's valuable data must be protected. If API endpoints are visible in the client's browser and there is no authentication, a scraper can steal all data. The data is the product, and the data must be protected.
By Pawan Nayar · from the LLOS AI Learning record
A web application's valuable data must be protected.
If API endpoints are visible in the client's browser and there is no authentication, a scraper can steal all data. The data is the product, and the data must be protected.
A web application must hide its API endpoints from the client's browser. It must use a secure proxy server. The proxy server must check for a valid session token. It must also verify a unique signature for each request. The server must limit how many requests an IP address can make. It should only accept requests from its own domain. The server should also detect and block suspicious activity.
A developer builds a website that shows unique dictionary entries. The website's JavaScript code directly calls the API that provides these entries. A scraper program can read the JavaScript, find the API address, and download all dictionary entries. This happens because the API has no security checks. The developer loses their valuable data.
Resolved from this lesson's own record — real definitions, not invented for this page.
More from the same record, pulled by shared topic — not written new for this page.
When a developer's code calls an external API, it should try only one time. The developer must not use loops to retry the call.
A developer must create a new backup right before editing a file. An old backup, even from the same day, can lead to lost work.
An old backup means losing all work done since that backup was made. A backup from several hours ago is not a safety net.
A developer must never use a free-tier Google API key. Free tiers can use user data for training.
A web application's valuable data must be protected. If API endpoints are visible in the client's browser and there is no authentication, a scraper can steal all data. The data is the product, and the data must be protected.