使用Javascript调用与应用程序名称和App密码一个REST API - 如何保护它 [英] Javascript Calling a Rest API with App Name and App Password - How Can i Secure it

问题描述

我相信这个问题已经被问了很多时间。

但想重新确认我的怀疑，并得到一些提​​示。

我正打算玩弄buddy.com后端即服务。
而我看​​到的大部分REST API的需要，如果你正在使用JavaScript应用程序名和密码被嵌入。
他们没有为JavaScript任何文件，但。
但不知道如果我要开始使用普通的HTML或HTML5的Web应用程序，现在用它从Javascript。我如何使用它。

我不希望传递应用程序密码的明文为任何人都能做到的浏览器的查看源文件或可以运行小提琴手，看看有什么被调用。
我知道一旦会说，嘿，你为什么不使用令牌系统，有效的特定时间。

但我消费在这里，
我怎样才能保护浏览器，因为我将呼吁通过网页/应用程序的Java脚本API的查看源代码密码为看到的。

buddy.com API

的

典型的例子

<一个href=\"http://webservice.buddyplatform.com/Service/v1/BuddyService.ashx?Pictures_ProfilePhoto_Add&BuddyApplicationName=\" rel=\"nofollow\">http://webservice.buddyplatform.com/Service/v1/BuddyService.ashx?Pictures_ProfilePhoto_Add&BuddyApplicationName=&BuddyApplicationPassword=&UserToken=&bytesFullPhotoData=&ApplicationTag=&RESERVED=

任何提示将不胜AP preciated。
谢谢

解决方案

在运行客户端的JavaScript总是可以的GreaseMonkey修改。 所有的变量可以用JavaScript调试器如萤火虫读取。 所有请求可以截获并修改 tamperdata 。

其结果是，您不能 JavaScript的信任，因为它的客户端code。为了保守秘密从攻击，你需要把它从JavaScript。你可以用一个中介API，它知道的秘密，执行代表客户机的请求做到这一点。这个API需要强制认证，或谁有权访问给定资源。

I am sure this Question has been asked a lot of time.

But wanted re-confirm my doubt and get some tips.

i was planning to play around with buddy.com back end as a service. and i saw that most of their REST API requires App Name and Password to be embedded if you are using JavaScript. They don't have any documentation for javascript, yet. But was wondering if i have to start using it right now from Javascript using normal html or HTML5 web app. how do i use it.

i don't want to pass App Password in the clear text as anybody could do a view source of the browser or could run fiddler to see what's being called. I know once would say, hey why don't you use the Token system valid for a particular time.

But i am the consumer over here, How can I protect the password being see in the view source of the browser since i would be calling the API through the java script on the web page/ app.

Typical example of buddy.com API

http://webservice.buddyplatform.com/Service/v1/BuddyService.ashx?Pictures_ProfilePhoto_Add&BuddyApplicationName=&BuddyApplicationPassword=&UserToken=&bytesFullPhotoData=&ApplicationTag=&RESERVED=

Any tips would be greatly appreciated. Thanks

解决方案

JavaScript running by the client can always be modified with GreaseMonkey. ALL VARIABLES can be read with a JavaScript debugger like Firebug. ALL REQUESTS can be intercepted and modified with tamperdata.

The result is that you can never trust JavaScript because its client side code. In order to keep a secret from an attacker, you need to keep it from JavaScript. You can do this with an intermediary API, that knows the secrets and performs requests on the client's behalf. This API needs to enforce authentication, or who has access to a given resource.

这篇关于使用Javascript调用与应用程序名称和App密码一个REST API - 如何保护它的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！