Javascript Calling a Rest API with App Name and App Password - How Can i Secure it

Question

I am sure this Question has been asked a lot of time.

But wanted re-confirm my doubt and get some tips.

i was planning to play around with buddy.com back end as a service. and i saw that most of their REST API requires App Name and Password to be embedded if you are using JavaScript. They don't have any documentation for javascript, yet. But was wondering if i have to start using it right now from Javascript using normal html or HTML5 web app. how do i use it.

i don't want to pass App Password in the clear text as anybody could do a view source of the browser or could run fiddler to see what's being called. I know once would say, hey why don't you use the Token system valid for a particular time.

But i am the consumer over here, How can I protect the password being see in the view source of the browser since i would be calling the API through the java script on the web page/ app.

Typical example of buddy.com API

http://webservice.buddyplatform.com/Service/v1/BuddyService.ashx?Pictures_ProfilePhoto_Add&BuddyApplicationName=&BuddyApplicationPassword=&UserToken=&bytesFullPhotoData=&ApplicationTag=&RESERVED=

Any tips would be greatly appreciated. Thanks

If they don't provide a way to generate client-side keys (like OpenTok or Twilio Client do) you'll need to proxy the requests through your own back-end for users authenticated with your app. — John Sheehan
– John Sheehan, Commented Jul 2, 2012 at 5:09
Thanks, I know that Back end would be easy. But If you wont to do that through the javascript is there a way to secure it? — Rahul
– Rahul, Commented Jul 2, 2012 at 16:32

Mikey · Accepted Answer · 2012-07-10 23:00:09Z

1

JavaScript running by the client can always be modified with GreaseMonkey. ALL VARIABLES can be read with a JavaScript debugger like Firebug. ALL REQUESTS can be intercepted and modified with tamperdata.

The result is that you can never trust JavaScript because its client side code. In order to keep a secret from an attacker, you need to keep it from JavaScript. You can do this with an intermediary API, that knows the secrets and performs requests on the client's behalf. This API needs to enforce authentication, or who has access to a given resource.

answered Jul 10, 2012 at 23:00

Mikey

8245 silver badges6 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Javascript Calling a Rest API with App Name and App Password - How Can i Secure it

1 Answer 1

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related