2

We are building a service that uses location-based pricing. The user can input an address and see prices in his area as determined by various server-side algorithms. It is then possible to order items based on these prices.

I'm trying to figure out if there is a way we can use client-side geocoding in this scenario (to avoid hitting Google Maps API usage limits), e.g. the user enters his address and the browser fetches the geocode result using the JS library and includes it in the form submission. The problem is that the user could tamper with the form submission and potentially place orders to his address for prices that apply to a different set of coordinates.

I'd like to hear your suggestions about how I can secure this. For example, it would be amazing if the geocode result could be signed somehow to verify that it hasn't been tampered with?

Nikolaj
  • 1,121
  • 1
  • 7
  • 10

3 Answers3

5

Never trust data created clientside. Anything you can do client side, they can.

Community
  • 1
  • 1
Kristoffer Sall-Storgaard
  • 10,576
  • 5
  • 36
  • 46
  • If the Google Maps API signed the result that would be one solution. I am aware of the tampering issue, this is why I asked the question. – Nikolaj Sep 16 '10 at 13:59
  • Doesn't matter whether Google signs the result. The fraudulent client would tamper the data provided _to_ Google, and Google will return a signed but tainted result. – MSalters Nov 19 '10 at 15:23
  • @MSalters: No, Google's results include the query and the result signed. – Nikolaj Mar 28 '11 at 13:12
2

If you want the client machine to do the request, you are going to be a bit limited in the security aspect of this, as it would all be javascript, and a malicious user could inspect the script and see what you are doing. Therefore even attempts at "securing" it would be limited in success.

My only recommendation would be to do a "final validation" serverside just as the user is submitting their results. This should reduce the API hits on your server side, but will keep the security 100% valid.

Mitchel Sellers
  • 62,228
  • 14
  • 110
  • 173
  • Yeah, if I do a final validation as the order is placed I suppose it becomes a luxury problem of having too many people wanting to buy stuff :) – Nikolaj Sep 16 '10 at 14:02
  • Bingo! You get the benefit of local user storage, but the security of validating it yourself. – Mitchel Sellers Sep 16 '10 at 14:27
1

If the data's stored on the users' machine, they can do what they want with it. You might be able to encrypt it or something, or maybe store an ID to a table of geodata (like a zip code, but make up your own similar system) or a hash of the geodata or something, but whatever's stored on their machine is theirs.

dda
  • 6,030
  • 2
  • 25
  • 34
FrustratedWithFormsDesigner
  • 26,726
  • 31
  • 139
  • 202