将信息从源站点传递到 JavaScript 应用程序链接的安全方法？

Question

So I have built a JavaScript website (call this "SapUI5 application"). I need this application to be opened from a third party website (call this "Job site") which I have no access to the source code, the only thing I can do there is edit one field (where I put my link), and there I can write html, Javascript code to format my link. The problem is, my SapUI5 application needs 1 information (an int) from the Job site, and what I did is I use "getElementById" in the Job site field, then I pass it (concatenate) to my link. It is working fine, but the problem is that if somebody edit the link by hand, they can access other people's data that are in my SapUI5 application store. I guess there should be a way to send this information (integer) through more secure way, but without Source code I have no idea what are my options.

Simply put: There is a field in the Job Site that can process html, javascript code, people will open it, and it needs to pass information to my link, to know which user opened the link.

Answer 1

I don't know any way to protect it on client side. Expert user can manipulate client side encryption. You can add some challenge with js for encrypt user id but, it will not stop expert users. You need add encrypted variable in backend side. May be you can publish Job site with proxy server and manipulate response for adding encrypted variable with proxy server (for example nginx).

Answer 2

just with client side scripting there is no good way. you need to add an authentication method. ideally single sign on, so that the user doesn't recognize it.

are you able to use javascript to generate the url from the application where you don't have any access? I can imagine that you can generate a key with current date time etc. and recheck this key on your webservice you program, where you have access at... but this is not pretty clean and secure