Oliver Heilig oliverheilig

Hiding your xServer internet token

The xServer internet token is an API-key used to authenticate and bill the requests.

If a client-application accesses xServer internet directly, the token can be sniffed by intercepting the traffic or looking into the code. However, the API-key cannot be used to access any security relevant customer data. If you don’t want to expose the token to the client, you can proxy the xServer internet access in your application server and inject your token here.

Here are two scenarios to create a proxy that injects an xServer internet token.

1. Use Apache as Proxy

You can add a virtual host to proxy your xServer-Requests, by configuring the httpd-vhosts.conf. The xServer can be acessesed with the authentication of your WebServer then, while the requests are relayed and the token is injected.

	// Calcluate airline distance for two mercator points.
	// This approximation formula is sufficiently accurate for
	// our needs for distances of up to 600 km and
	// 80° latitude (the error is never more than 5% even for extreme values).
	using System;

	public class Program
	{
	public static void Main()
	{