JavaScript 应用程序到 Symfony API 其余身份验证

Question

I already Googled that, but I didn't found any answer that satisfy me, maybe because it's impossible.

I want to know if I can authenticate a website directly from JavaScript to a Symfony API rest. My goal is to create a script in JavaScript, which make ajax requests to the API (the API accepts cross origin requests) and get some data in the response, but the website(s) needs to authenticate with the API to get this data.

I can certainly use JSON web tokens or OAuth to make the website authenticate as a user, but in this case I need to have some script on the server side of the website and call it from ajax to get the website authenticate and return the token in the response. I don't want to store anything on the website, only put my script tag in the html, to facilitate the installation of the service(it's a widget) for webmasters.

I also know that I can do that with referrer authentication, but I will avoid that, everyone can change referrer in the request headers. I can also put an apikey in the link of the script <script src="mydomain.com/myjs.js?apikey=MY_API_KEY"> but everyone can access the apikey and use it from everywhere.

Is there a way to do that safely?

Answer 1

After some research I think the only solution is what I already done, apikey-referrer authentication:

How to keep API keys secret when using client side Javascript?

How does Google Maps secure their API Key? How to make something similar?