Block unwanted use of json API

问题:

I have a website where you can request data using ajax from our servers as json (only to be used on our site). Now i found that people start using our requests to get data from our system. Is there a way to block users from using our public json API. Ideas that i have been thinking about is:

• Some kind of checksum.
• A session unique javascript value on the page that have to match server-side
• Some kind of rolling password with 1000 different valid values.

All these are not 100% safe but makes it harder to use our data. Any other ideas or solutions would be great.

(The requests that you can do is lookup and translations of zip codes, phone numbers, ssn and so on)

回答1:

You could use the same API-key authentication method Google uses to limit access to its APIs.

• Make it compulsory for every user to have a valid API key, to request data.
• Generate API key and store it in your database, when a user requests one.

Link: Relevant Question

This way, you can monitor usage of your API, and impose usage limits on it.

As @c69 pointed out, you could also bind the API keys you generate to the API-user's domain . You can then check the Referer URL ($_SERVER['HTTP_REFERER'] in PHP), and reject request, if it is not being made from the API-user's domain.