匿名JavaScript客户端中的REST API身份验证

Question

I have a JavaScript client (HTML page) invoking a REST endpoint. I want to have some kind of authentication. My problem is that anyone can view the source of the webpage and see the JavaScript. How can I store some secret/key to invoke the API from JavaScript?

1. Users are anonymous.
2. Web page is not hosted by us but it allows us to hook our JavaScript. There is no way for us to write server side code.

Answer 1

A little secure way is to store the key in local-storage / indexeddb .. instead of hard coding it in javascript.

Or either obfuscate the javascript code. Try services like

https://javascriptobfuscator.com

or any similar to obfuscate the js code.

Answer 2

The OAuth2 specification makes provisions for a pure browser clients via the OAuth2 "implicit grant" .

The implicit grant type is used to obtain access tokens (it does not support the issuance of refresh tokens) and is optimized for public clients known to operate a particular redirection URI. These clients are typically implemented in a browser using a scripting language such as JavaScript.

If the service provider you are interacting with supports the OAuth2 implicit grant flow - you are home free.

It requires that the client identifier (the client key) is linked to a specific redirect_uri, so that even if the client identifier is lost, nobody else can use it - because the oauth flow always redirects to the same URI.

Therefore it becomes unimportant to safeguard the actual client identifier, even if it is intercepted, nobody else can use it to get hold of an access token.