I need to send an ajax POST request to my server.

I'll need to make sure that the request originated from the script itself, and not from a user writing the request him/her self. Is there any secure way to do this? Can the script sign or encode the POST request, later to be decrypted by the server's private key? and can I somehow prevent the user from encrypting using my public key?

I'm not doing this just for filtering purposes - so plain old server-side validation just won't do.

I need to send an ajax POST request to my server.

I'll need to make sure that the request originated from the script itself, and not from a user writing the request him/her self. Is there any secure way to do this? Can the script sign or encode the POST request, later to be decrypted by the server's private key? and can I somehow prevent the user from encrypting using my public key?

I'm not doing this just for filtering purposes - so plain old server-side validation just won't do.

• javascript
• security
• rsa
• public-key

• Why won't plain old server-side validation do? – deceze ♦ Commented Feb 22, 2010 at 7:08
• i'm doing this for a browser extension, not a website.. i need to push stuff to the server, but i need to know that im sending the request, not someone else.. – daniel Commented Feb 22, 2010 at 7:35
• Same thing then. Even if your extension was a piled binary, (apart from disassembling it) one could sniff the raw data being send and repeat the exact same request. The server couldn't tell the difference. Once code is on the client all bets are off. – deceze ♦ Commented Feb 22, 2010 at 7:44

4 Answers 4

Anything you do in Javascript can be seen and analyzed, as it's happening on the client side. So encrypting information securely client side is pretty much impossible. That leaves the server as the only point where you can and need to do validation.

Also, why would you care if an input es from your script or is hand-crafted by a user? If the input is valid and allowed as defined by your rules, it shouldn't make any difference.

For this kind of situation, when in doubt, you need to see the importance of client/server separation. Your server is your app, it's the one and only critical ponent that you need to take care of. Every input is generally untrusted, every output must be exactly what you intend to disclose.

The HTML/JS interface you're handing to the user is just a help for the human to municate with your server, but that doesn't mean it's trustworthy or securable once it has left your server.

The other answers are correct: this is fundamentally impossible. Probably the best you can do from a pragmatic point of view is to look into really nasty ways to obfuscate your JavaScript to discourage people who might try to look at it, but you can be assured that someone motivated can work around this without too much effort. http://en.wikipedia/wiki/Obfuscated_code

I'll need to make sure that the request originated from the script itself, and not from a user writing the request him/her self.

From the point of view of your server 'the script' and 'a user' are indistinguishable. What you are asking for is fundamentally impossible.

You can't use public key cryptography in pure JS, because the private key (used for signing data) will be exposed. Generally speaking, what you're trying to do is impossible.