In my shoppingcart appliction i use google analytics ecommerce for analyzing purchases.
The user pays for the order using ogone. When the user comes back from ogone I handle the order and return a view which contains javascript to post the data to the google servers. This is all working great.
However when a users doesn't return to the website after the payment (by for example closing the browser) The ogone server sends a request with the payment data to a function on my shoppingcart. There i handle te order and return a view with the javascript to post the data to the google servers. But since javascript is executed on client side, will this javascript be executed ? I am not getting any results from this request (the normal one does work)
Any clues or suggestions for a better way to handle ecommerce when the customer doesn't return to the website?
To avoid the issue you should perform the log operations in your server side code - at the end the entire API is based on HTTP requests and nothing more so you can use HttpWebRequest or HttpClient class.
I'm assuming that for your purchases analysis you are tracking transactions, in that case there is a ready to use library for you:
GaDotNet
You can use it directly or analyse it source code (available at GitHub) to provide your own implementation.
Related
I have a controller like the image below. This controller hides the relevant record in the database when the fetch request is sent. Do I need to use http post for such operations in this project that I wrote with Entity framework core? The problem with this controller is that the admin executes the javascript code fetch(https://localhost:5001/admin/deletepost?delete=url) on any page. As soon as this get query runs, the relevant record is hidden or deleted from the database. Is it safe as it is? How can I make it more secure? Thank you very much to everyone who replied.
Although this method is only accessible to the admin, will the deletion of the record as a result of the admin sending this request cause a deficit?
For several reasons, POST is more secure than GET.
GET parameters are passed through the URL. This means that the parameters are stored in the server log and browser history. When using GET, you can also easily change the data submitted to the server because it is in the address bar.
The problem when comparing the security between the two is that POST may block temporary users, but it cannot block malicious users. It is very easy to forge a POST request and should not be fully trusted.
The biggest security problem of GET is not the end user's maliciousness, but the third party sending a link to the end user.
Another point is that you must consider where to use GET and POST, because GET should only be used for operations that do not change database information, and only request or read information and POST data should be used when the data will be changed.
Some web scanners will automatically click on each link (usually a GET request) instead of in a button or form (usually a POSTS request) to avoid changing the database, but for example, if you perform a delete operation after the link, you The risk of clicking on the link may be easier with more automated tools.
I've made a simple webapp that is going to show some data in a table, which will be updated weekly.
This update it done in the backend with some python code, that scrapes and alters some data, before putting it in a SQLite database.
After doing some reading I learned that to deliver that data to my webapp I should make a API with Flask, that can take that data and deliver it to the JS in my webapp in form of JSON, which then can use the data to populate the table. However, I should secure my API with username and pw. But as its a JS frontend that will retrieve data from the API, there is really no point, as the username and pw will have to be hardcoded into JS, which then can be read by the users. (I think)
Should I expose my API to everyone, or is this not the way to go to be able to use SQLite data as a backend for my webapp? I am fine keeping the API to a GET only.
You are correct, it is pointless for you to secure your API. Securing an API is only needed in certain circumstances.
If you are accessing data that you don't want anybody to see, perhaps through a backend call, then it would make sense to add in some form of security (normally an API key or Authorisation tokens in your request headers).
However, if you are making calls from your front-end (i.e. client side) to a backend API, then there is no point putting additional security there as the user can already see the request and already has access to the data the API is returning - so by securing it you are achieving nothing.
Normally, if the page the user is visiting contains sensitive data that you don't want everyone to see, you would take steps to secure your website instead (for example protecting it with a login for username and password before you can access that page). If you were to take this approach, where the website is protected by username and password, then you can update the API to make sure it does not respond to requests where the user is not authenticated (e.g. by generating a session token or something unique for each logged in user).
If you have a look around on websites that have lots of free data available, you will find they all have front end API calls that are completely unsecured (because it is pointless if the data is already free to access). Some websites do take steps to try to make sure it is their own website that is calling the API, but even then it is a bit pointless as web scrapers can always extract the data from the HTML.
Take a look at this page which outlines authentication headers. This simpler route is to hard code the header info in Flask to make it a little more secure. You could also try the more involved route of reading header info from your db. What's currently working for me to read from postgres db is below so you may modify it slightly for sqlite.
def valid():
headers = request.headers
auth = headers.get("X-Api-Key")
user = User.query.filter_by(apikey=auth).first_or_404()
print('from search of db ',user,'',auth)
return str(user)
As you mentioned, you plan to show a public data - then it can be used even
without authentication. Otherwise I think it can take too much unnecessary time spent on that.
As you have just a simple and single table from database, I believe that you don't need an API. You can just create HTML template and render it with data. Some examples can be found here and few more here.
I am creating a web app in Angularjs which displays data from a 3rd party API (json). This is not a free API, I have to pay based on the amount of calls made.
I am given an API key which I call like this:
https://apiservice.com?key=1234567&p1=x&p2=y
I want to ensure that my api key is used only by my web app, so I created a proxy on my server. Now my angular app calls my server like this:
https://myserver.com/myapiproxy/?p1=x&p2=y , the server makes the call to the api using the key that is kept on the server, and returns the json data to the client. This way the key is kept secret.
However there is currently nothing to stop somebody else from calling "myapiproxy" and get the data.
Is there a way to ensure that only my app gets the data and that others can not make calls to the api on my expense?
I searched for a few hours and I couldn't find a truly secure answer. HTTP referer is not a good answer because it can be easily spoofed.
Take a look at JSON Web Tokens - https://jwt.io/
It is a good way to secure your calls. It has angular module - https://github.com/auth0/angular-jwt
When user loads your app you can provide a token jenerate on the backend and store it in local storage.
Than on each api call you can check if this token is authentic.
Circumstances
I develope a WebApp with AngularJS.
I've an restful API on server-side with GET and POST commands.
I want to use the API within my module (means: in JavaScript) to display and edit my data.
I want to protect the API with some kind of authentication (basic auth with an API key for example)
I don't want to protect the API when a user uses the app itself
Actual question
Okay, I guess the last point is a bit unclear.
I want that a user can use the app with his browser without any authentication
But when a third-party app want to access the API it have to use authentication
Since JavaScript is executed on client-side of course I can't write a master key into js or something similar..
Is there any kind of pattern or solution to solve this problem?
More specifications
referring to #EliranMalka and #shaunhusain
On the server-side I do use Tornado with it's builtin template engine. I do use the template engine actually just to write the index page and insert CSS, JS dynamically.
The code for authentication would just something like:
def is_authenticated(request):
if 'api_key' in request.arguments:
return sql('SELECT id FROM keys WHERE key=%S' % request.arguments['api_key']).count == 1
My AngularJS module is doing something similar to:
$http.get('/api/foo?api_key=1234')
.then(function (result) {
$scope.data = result.data
});
As you can see I'm writing my API key into js at the moment. But I wan't to avoid this.
Also, what do you mean exactly by third-party?
not a third-party request would be: Using the App on http:/ /app.example.com with a browser
A third-party request would be from an Android app for example. Something that comes from outside or remote.
A JS request from the browser on the actual page would be not from remote (again: since it's JS it is actually from remote - but I hope it gets more clear now)
Oh and before I forget...
I'm aware of that my plan is a bit weird - but it's just a learning(-web-development)-by-doing project.
Also the API key is not absolutely to avoid abusion, it is rather to log 3rd-party usage.
PS I hope my question was clear for you
Hmm, well I'll try to address the questions but here's a few things.
Question isn't really appropriate in it's current format for stackoverflow.com (should be programming questions, I tried X and Y happened) perhaps closer to a StackExchange question but is still fairly open ended.
Include more information about specifics of the languages (and/or frameworks) your using server side and any code you have that is relevant (authentication code?).
Putting the key into the client code and transmitting it from the client means anyone with a web proxy (check out Charles or Wireshark) can grab the key so just to reiterate you're right there that's not the way to go.
Check out how other organizations allow you to get access to their APIs (for example Google, LinkedIn, Facebook, Twitter) to get a feel for how it works. In all of these cases you are signed into the service to be able to make an API key, in some cases you have to specify which domain the requests with that API key will come from. If you use the same precautions and check the API key sent with a request against a database of registered API users and verify the domain in the request then I'd say you're in pretty good shape.
I want to setup a Shopify Webhook on the Order Cancellation event that will cause some javascript code to be run.
In this specific case, I want to send a negative transaction to Google Analytics to remove the transaction when an order is cancelled (as described here: https://support.google.com/analytics/answer/1037443?hl=en )
I have my callback url / page setup (PHP) and it works correctly when loaded in a browser. But the webhook apparently (obviously?) does not trigger any client side code to run.
Any ideas on how I can make this happen?
Although this does not solve the question specifically (of running javascript via a webhook) an alternative solution for this specific case would be to use Server Side Google Analytics tracking to send the negative transaction:
https://github.com/thomasbachem/php-ga
https://developers.google.com/analytics/devguides/collection/protocol/v1/