Search code examples
angularjsjsonrestencryptiontamper-data

How to prevent JSON data from being Tampered in a REST request?

The following is the architecture of my Web application.

  1. Web UI(Angular JS) running on nginx
  2. Back-end data access layer (Java App) running on glassfish app server

My question is, how can I prevent a valid user from tampering or manipulating the REST service JSON request using some proxy tool.

One thing that I thought of was to encrypt the JSON but this will still expose the public key and the source code of how to encrypt it since its done on client side scripting. Is there a better way of doing secured JSON request?

P.S: I'm not talking about "Man in the middle Attack". This is not related to session hijacking. This is about a valid session user tampering the POST request using tampering tools.

Solution

  • You can't.

    Anything that runs on client-side is exposed. Almost everything there can be tampered.

    So your best bet is that you have a strong server-side validation before you process the data from the client.