So I'm stuck trying to figure out how Google Analytics avoids spoofing. Sure, when you sign up for an account, they make you verify that you own the domain by uploading a file. But you are also given some script tags with a unique public code (replaced with 'XXXXXXX' below). What's stopping somebody from copying that code, spoofing the request headers, and pretending to be my site by following Google's authentication strategy with curl?

<script type="text/javascript">

  var _gaq = _gaq || [];
  _gaq.push(['_setAccount', 'XXXXXXX']);
  _gaq.push(['_trackPageview']);

  (function() {
    var ga = document.createElement('script'); ga.type = 'text/javascript'; ga.async = true;
    ga.src = ('https:' == document.location.protocol ? 'https://ssl' : 'http://www') + '.google-analytics.com/ga.js';
    var s = document.getElementsByTagName('script')[0]; s.parentNode.insertBefore(ga, s);
  })();

</script>

The reason I ask is because I'm trying to create a similar JavaScript plugin that exposes my site's data to participating websites ("clients"). I'm not sure how I can get this functionality without a private key on the client's server side. That kind of sucks because I was really going for the whole "easy as Google Analytics to integrate". Any thoughts?

javascript security node.js
Edit
Report