Secure layer options

[JoepRonde]

I've created a map with the ArcGIS API for JavaScript similair to the one in the samples (Legend | ArcGIS API for JavaScript 3.17). I've split all layer options in a seperate layerConfig.js file so that I can easily add/remove layers withouth changing the rest of the application. The layers in this config file are served by an ArcGIS server and are secured with token based authentication and user login. That works fine. The application asks for a login before you can actually see any data on the map. The problem is that the layerConfig file contains urls and layernames that might be sensitive to our clients and I don't want them to be public accessible. 

What's the best practice to secure this kind of config information? 

[JoepRonde]

I got a solution for this problem from a product consultant of ESRI nl. He suggested to put the layerconfig as a json text in a  feature table and publish this from the ArcGIS server. When starting the app I could do a REST request to retrieve this the layer config. This way the ArcGIS server secures the layer config information as well as the geodata.

Although this solution should work, I don't find this an elegant solution and was hoping there would be other best practices for this problem.