如何在Google Chrome扩展程序中保护API密钥？ [英] How to secure an API key in a Google chrome extension?

问题描述

我正在研究Google chrome扩展程序，该扩展程序基本上符合我们的API进行搜索并列出结果。我们希望扩展程序具有较高的API权限（例如，它可以访问普通用户不需要的数据，并且每天不会有通常的200 /请求限制），但我们不确定如何确保该扩展使用的API密钥。用户可以轻松使用chrome中包含的开发人员工具查看扩展源（因为它只是HTML，CSS和JavaScript），或者在制作API请求时观察API请求并从中提取API密钥。

任何人都知道我们如何在Chrome扩展中保护API密钥？我仔细阅读了google chrome扩展文档，看看有没有什么可以帮助我们，但我还没有找到任何东西。

谢谢！

解决方案

如果您的扩展可以向您的服务器发送请求，任何用户都可以使用Fiddler来检查请求并模拟扩展。 b

你无能为力。

I'm working on a Google chrome extension that basically hits our API to do a search and lists the results. We'd like the extension to have elevated API privileges (i.e. so it has access to data a regular user doesn't, and doesn't have the usual 200/requests a day limit), but we're not sure how to secure the API key used by the extension. A user can easily use the developer tools included in chrome to view the extension source (since it's just HTML, CSS and javascript) or watch the API requests as they are made and extract the API key from that.

Anyone got an idea of how we can secure an API key in a chrome extension? I've perused the google chrome extension documentation to see if there is anything that may help us but I haven't found anything.

Thanks!

解决方案

If your extension can send requests to your server, any user can use Fiddler to examine the requests and impersonate the extension.

There is nothing you can do about that.

这篇关于如何在Google Chrome扩展程序中保护API密钥？的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！