0

If I want to make a API call to third party API from client side. What are security measures to be taken ?

Is there a way to hide URL and Authentication parameters securely in client side ?

How to restrict the user to not to see this API call details in browser network logs ?

And what is the best authentication mechanism for this type of integration ?

Will the callout that we do from the client-side will it count for concurrent-Long running transaction - 10 if it exceeds more than 5 secs ?

3

Is there a way to hide URL and Authentication parameters securely in client side ?

No.

How to restrict the user to not to see this API call details in browser network logs ?

A clever user can see all network activity in their browser's console. There's no way to circumvent this.

And what is the best authentication mechanism for this type of integration ?

You can use whatever method you prefer. If you need to hide authentication information, use server-side code instead.

Will the callout that we do from the client-side will it count for concurrent-Long running transaction - 10 if it exceeds more than 5 secs ?

Client-side will not, but server-side would.


Based on these questions, you might want to consider what you're trying to do. You may want to rethink your approach to logging in and/or using this API. I can't say much more without knowing more, but you must assume that the user can totally control everything on their computer and see all network activity. There's simply no way around it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.