Given that any user can read the the requests and responses of every AJAX call as clear text (by viewing the browser’s network tab) we are considering encrypting all AJAX data, to deter users from abusing our AJAX endpoints.

In your experience, does this practice actually serve as a deterrent to hackers wishing to understand the source code and exploit or abuse the endpoints. Or is there no benefit at all?

Would you says the benefit is equivalent to that of running your code through a reputable obfuscator? Or would you say the benefit is less than that?

We all know that when it comes to client side scripts, there is nothing we can do to stop a determined hacker. However, considering that most of our users are not exceptionally determined (e.g. unwilling to invest more than 10 hours in the endeavor of “unpicking” our API) it would seem that there should be best practices that would help reduce the likelihood of such an exploit.