How to hide api key using php?

Question

everyone. I'm trying to create league of legend api, but I need to hide the api key. I know there is no way to hide the key from the front-end, so this is how I did it, I'm not sure this is the best way to do it. Please help me!! Thanks!

HTML.file

var getID = function(playerName) {
  $.ajax({
    type: "POST",
    url:"test.php",
    dataType:'json', 
        data: {'url': "api/lol/na/v1.4/summoner/by-name/"+playerName+"?"},
    success: function(data){
       playerID = data[playerName].id;
       console.log(playerID);
    }
  });
};

So every time I'm calling ajax, I'm making a ajax request to the test.php file, and pass the url to it, then the php code will use the url to get request from the game server and send back the result to front-end.

test.php

<?php 
  header('Content-Type: application/json');

  $url = $_POST['url']; 

  $json = file_get_contents('https://na.api.pvp.net/'.$url.'api_key=key');

  $obj = json_decode($json);
  echo json_encode($obj, JSON_PRETTY_PRINT);
?>

Looks good to me, as long as everything in $json is public. Otherwise you would have to unset some elements before you encode and return it. — jeroen
– jeroen, Commented May 26, 2015 at 17:17

Ray · Accepted Answer · 2015-05-26 17:17:18Z

2

As long as the Ajax request will only trigger for a valid, authenticated user with an established session this looks good. Otherwise, anyone could call it with arbitrary 'playerNames'.

It will definitely prevent your API key from being exposed.

answered May 26, 2015 at 17:17

Ray

41.6k22 gold badges110 silver badges144 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

How to hide api key using php?

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related