用javascript保护REST OAuth的API客户端

Question

I am currently building a REST API in laravel that is using OAuth to authenticate, In short everything the API is working just as a presistence layer.

Here is an example of how the request looks like. I am testing it out in terminal thorough curl or an api testing tool

http://example.com/api/auth_token

// Parameters
grant_type: password
client_id: 12312312
client_secret: 56565567
username: fake@fake.com
password: pass

This returns an access token that is valid for an hour. And then this token has to be used for the actual request.

Now i want to use this api on a frontend framework like angular, jquery or simple javascript, but if i do that i would be exposing the user credientials, right? because there is no way to secure this in javascript.

I know there has to be a way because this a very common way of how nowadays RESTFULL system work. Anyone aware of how its done?

Answer 1

Make a HeaderToken which is being passed on every request. Refer this one http://devcenter.kinvey.com/rest/guides/security