We Keep Coding

Abstracting/restricting calls to back end API that is exposed in Javascript

Working on a simple HTML application that makes calls to an API using jQuery. Would like to avoid someone getting the API address (via looking at the source and/or network traffic) and making calls directly to the API without the HTML pages getting loaded first. Thinking about adding a header or cookie that the API can validate to ensure this request is coming from the Javascript embedded in that page, and not someone calling the API direct. However, even this could be replicated by someone looking to talk to the API directly. Would like to keep this a simple HTML project as much as possible (realize creating a Node.js version of the application, or using Thymeleaf in Spring Boot would give more options to obscure the API). It feels like this is a limitation of doing an HTML/Javscript solution. But, maybe we are missing something obvious. Any tips?

How to handle client app not having an internet connection temporarily when dealing with a REST API?

I have a basic API built using the spring framework. It is a fairly simple REST API for now.
The app that goes out to clients who are registered to use the API will be making requests to and from said API.
However, so far - I haven't really looked into how to consider if that client loses an internet connection for a few hours or whatever, or if our API were to go down for some reason.
From a design point of view, I would imagine we would handle the response from Spring which basically says "There was no response" - use that to assume communication has failed between the two locations for some reason, and then add the request to a queue in order to try again in a little while?
Now, I would google this - I am sure there is information pertaining to this online, but I am not really sure what this problem or solution is even called - or if a queue is even the best way to handle it.
I'm not really looking for a working solution, or code or anything right now - more so some basic spitballing of ideas on how this can be done - best approaches vs not so good ones, etc. Some library and framework suggestions would be cool too.
Maybe Spring has something built in that I don't even know about yet?
The API is built in java, but the frontend app will likely be using javascript I would imagine - as we don't want to build the same app for multiple mobile platforms.

If you are willing to experiment with cutting edge web technologies service worker might be something interesting for you.
developers.google.com Codelabs Offline Web App

JavaScript Security Risks In Hybrid Mobile App

Let's assume HTML5 web page with (in)appropriate server-side background so that http://www.my-site.com/execute?query="SELECT * FROM Table" gets executed via AJAX and returns results. Not very smart, indeed.
But how about when in context of hybrid mobile app, i.e. HTML5 app inside iOS/Android/WindowsPhone wrapper/skeleton delivered as an application through appropriate store?
Q: Do we consider JavaScript safe when in context of hybrid mobile app?

I would say no.
If somebody looks at your network communication, or maybe if you accidently forget some debug logging, it's probably fairly easy to find out the url.
And the query probably would also work when called in a browser (being mobile or desktop).
Of course you can ask yourself: how popular is your mobile app and would anybody even try to hack it. But I wouldn't bet on that.
Edit: we usually use something like a (REST) API, and the answer from the server is JSON which is then parsed by the client. Don't let anybody be able to type in SQL queries!
A: In terms of "security" on iOS: you can browse the device with e.g. iExplorer. On Android, there are also ways (rooted device or adb). Given the phonegap structure, your javascript would then be located in the "assets_www" folder or similar. So if somebody wants to, he/she can look at the javascript source just like on the web.

It will cause a serious misery.
Once someone finds your AJAX url, they will be able to delete or insert anything into your database.
Reverse engineering of applications is very common, so one will be able to find your AJAX URL very easily once they just decompiled your app. Hybrid mobile apps can be very vulnerable if you think of them like native apps.
Additionally, using proguard will not help securing your html/js source codes, so you'd better just think of them as websites' front-end where all the sources are open, and keep the same level of security.

access iPhone GPS from javascript webview

I have a basic query while developing hybrid iPhone application
1) How can we access iPhone native functionalities like GPS from web UI javascript WITHOUT help of third party frameworks like quickconnect iPhone or PhoneGap
2) What is the flow , architecture for the same? i.e. how javascript communicates with the native code.
3) All comments, URL, information for the same are most welcome!
4) Can I upload my app on appstore using quickconnect?
5) I think using phonegap, we cannot upload on appstore, we have to upload on phonegap only. plz comment
Thanks

1) How can we access iPhone native functionalities like GPS from web UI javascript WITHOUT help of third party frameworks like quickconnect iPhone or PhoneGap
Check out the HTML GeoLocation API. Apple also exposes other cool stuff like accelerometer data via JavaScript APIs. So you don't always even need native code.
2) What is the flow, architecture for the same? i.e. how javascript communicates with the native code.
Actually, for some information, like location data, you do not need native code (see above). However, in general, if you want to communicate with native code from a WebView in an iPhone application, you would usually register a URL handler in the WebView's delegate, then do some fancy tricks with window.location to trigger the handler when needed. To send data back to the WebView, you just need to use the self-explanatory [webView stringByEvaluatingJavaScriptFromString:(String)] method.
For communication like this, I usually end up writing my own little library that allows me to call certain native handler methods from JavaScript and also register to receive messages from the native code. You'll probably end up doing the same. It's simple, intuitive, and fun. I recommend the experience.
3) All comments, URL, information for the same are most welcome!
See the links above.
4) Can I upload my app on appstore using quickconnect?
I've never used quickconnect so I can't answer that one.
5) I think using phonegap, we cannot upload on appstore, we have to upload on phonegap only. plz comment
I've never heard of people having trouble with posting a PhoneGap based application to the AppStore. Though I must admit I've never attempted it myself. I imagine that I would have heard if Apple had stopped accepting PhoneGap based applications. But Apple is pretty moody. So who knows?
(I'd check on my sources on that one if I were you, though)

Calling a webservice in javascript

I am trying to make a Firefox extension which will use a webservice. I was looking online to find a way to do this. I was wondering if someone could explain what the following objects/methods do:
service.useService(___, ___);
service.<Service Name>.callService();
If there is an alternative that does not include these objects, I would be happy to hear about it.
Thank you very much

It appears you are using IE specific code to call the webservice, and according to this response it may not be supported in newer browsers now:
http://www.eggheadcafe.com/software/aspnet/31984555/you-can-use-xmlhttpreques.aspx
For more on the service.useservice function you may find this page helpful:
http://www.15seconds.com/Issue/040708.htm
If you have control over the web service then you can get it to either reply with a JSON or use a REST web service, as well as a SOAP web service, as javascript can work well with REST, or with a form-based (POST/GET) web service, as opposed to SOAP.