且构网

分享程序员开发的那些事...
且构网 - 分享程序员编程开发的那些事

如何使用JavaScript时,保护一个API密钥?

更新时间:2022-06-22 00:20:22

简短的回答:没有。

无论你做什么混淆的关键,你还是得把它以使其可在客户端上不知何故,因此将有可能使用外汇进行解压缩。 Firebug的。

What ever you do to obfuscate the key, you still have to send it to make it available on the client somehow, and therefore it will be possible to extract it using fx. Firebug.

即使你设计一个真棒神奇的方式来保持关键的秘密,在某些时候,你将不得不作出实际的API请求,并且它必须从浏览器发送的,攻击者能够读取出从Firebugs净标签纯文本的关键。

Even if you devise an awesome magical way to keep the key secret, at some point you would have to make the actual API-request, and as it would have to be sent from the browser, an attacker would be able to read out the key in plain text from Firebugs net tab.

做的正确的事情是创建一个围绕需要钥匙API调用一个PHP包装,然后调用包装从Javascript。

The right thing to do is to create a PHP wrapper around the API calls that require keys, and then call that wrapper from Javascript.