pass secure data to jquery from php

Question

I have a token variable that I get with php and write to a div using the data-value parameter so that jquery can get it. I do not want users to see so I was wondering if it was possible to

Hide this data on the way to jquery (in the data-value parameter)
Encrypt the data in Jquery so when the header or sent parameters are displayed, token is encrypted or not visible

var token=$('#token').attr('data-value');

    $.ajax({
    type: "POST",
    data: "action=edit&token=" + token,
    url: "doc.php",
    dataType: 'json',
    success: function(response, statusText)

score 1 · Answer 1 · answered Jul 07 '11 at 20:41

1

It's not really possible to do this in any way that's going to be secure against a determined user who really wants to see that token.

answered Jul 07 '11 at 20:41

Paul Sonier

38,903
3
77
117

Then how can I stop people from finding out that token and then sending requests to my php scripts to execute commands I don't want executed? I am using a token to verify that a user is logged in and genuine, and I thought if I could hide it, then the user won't be able to send in custom requests because he won't know which token matches his username. – Scarface Jul 07 '11 at 20:43
Write your application without exposing your implementation details. i.e., don't think of PHP scripts as shell scripts you access via URLs. – wanovak Jul 07 '11 at 20:55
@wanovak I like that saying but if they see the jquery post has 4 variables including the token, why can't they just post a request with 4 variables including the token to make the script work? Someone gave me the impression that people can do things like that. Is that true? – Scarface Jul 07 '11 at 21:04
you can develop your application in such a way that it doesn't matter if they know the token or not. If you tell us a little more about what you're doing, we can be specific as to how. – colinmarc Jul 07 '11 at 21:29

score 0 · Answer 2 · edited May 23 '17 at 11:48

0

This post sounds similar:

Obfuscating POST variables between Javascript & PHP

There is no way known to me hiding a parameter. You can mess with almost all request data by using a debugging proxy like "Fiddler".

edited May 23 '17 at 11:48

Community

1
1

answered Jul 07 '11 at 21:22

madflow

7,718
3
39
54

score 0 · Answer 3 · answered Jul 07 '11 at 21:36

The only way to secure data between a web client and a server is to encrypt the channel by using SSL. Anything that the client needs to read in order to use (i.e. anything manipulated in javascript) is going to be visible to a determined user.

If there is some secret data that not even the user should see, it needs to be handled entirely on the server side without ever sending that data to the browser.

pass secure data to jquery from php

3 Answers3