Hello,
I recently conducted some tests in Chrome’s inspector and noticed that the API collection connected to weweb displays all the values returned by the API, including the route.
Although this feature may seem standard and mundane for front-end development, I fear that it’s not secure enough. In fact, I sometimes try to exploit flaws in APIs by examining key names for reverse engineering. This approach has even allowed me to uncover data providers from my competitors, among other things.
However, I have occasionally noticed that the API routes are not visible on certain sites or applications, even if the JSON result data is.
My first suggestion would be to determine if it’s possible to implement a technical solution so that the API route is not visible in the inspector.
My second suggestion, aimed at enhancing security and preventing reverse engineering, would be to encode the value keys. So instead of a presentation like this:
{
“user_id”: 2,
“entreprise_id”: 2,
“cache_bdd_id”: 0
}
We would have something like this:
{
“sMwCwrEb”: 2,
“yHhKOEGE”: 2,
“MdjdbVcS”: 0
}
While keeping in mind that a link should exist through the weweb editor to recognize that “user_id” corresponds to “sMwCwrEb,” etc.
Thanks
