How would I send analytics data forwarded to my backend to Mixpanel, as opposed to sending data directly from the browser?

[hamirmahal]

I'm curious whether I'd be able to obfuscate the URL I'm sending analytics data to, regardless of whether or not I'm using a proxy, by sending Mixpanel analytics to a my backend, which would then forward the analytics data to a proxy, or directly to Mixpanel.

This way end-users on desktop don't see the analytics URL in the Network tab of their browser DevTools.

[austinpray-mixpanel]

I think https://github.com/mixpanel/tracking-proxy meets your requirements. Is this what you are looking for? cc @ak--47

[hamirmahal]

I may take a look at https://docs.mixpanel.com/docs/tracking/how-tos/effective-server-side-tracking and https://docs.mixpanel.com/docs/tracking/reference/nodejs.

[hamirmahal]

The use case is just that I was concerned any user, upon viewing the Mixpanel API endpoint in the browser dev tools, can send arbitrary events and incorrect analytics data to that endpoint, since they can see what it is.

[ak--47]

@hamirmahal

i see... you're worried about people spamming your analytics endpoint? that's fair.

if you move all the API calls to the server, then the client will not see anything... that's one advantage to server-side tracking... however, a "server-side only: strategy may lose the ability to "track" actions on the client which are not necessarily triggering requests to the server (like scrolls, or certain page clicks) so i understand why this might not work for your use case.

people have expressed this concern before to me (many times) ... and it's a problem not just for mixpanel, but for every analytics product or service which exposes a "client side" endpoint for logging... if it's visible to the client, it could be spammed or abused... strategies like CSRF and rate-limiting tokens can be introduced, but that end up being nontrivial and more investment than it's worth.

i can say this: i've worked with thousands of customers (8+ yrs @ Mixpanel) and I have only seen the "client-side event spamming" behavior two or three times. it really doesn't happen frequently.

in the (rare) case this does happen, mixpanel offers governance tooling (lexicon) to drop certain events at ingestions, mark things as unexpected, etc...

https://docs.mixpanel.com/docs/data-governance/lexicon#dropping-and-hiding-data

[hamirmahal]

@ak--47

Oh, dang. That's really interesting. Thanks for the detailed response!

[ak--47]

@hamirmahal we now support configurable endpoints... so you can alias /track to /whatever:

https://github.com/mixpanel/mixpanel-js/releases/tag/v2.48.0