- html - 出于某种原因,IE8 对我的 Sass 文件中继承的 html5 CSS 不友好?
- JMeter 在响应断言中使用 span 标签的问题
- html - 在 :hover and :active? 上具有不同效果的 CSS 动画
- html - 相对于居中的 html 内容固定的 CSS 重复背景?
在 React javascript 文件上使用 API key 时是否有办法保护它的安全?例如;
emailjs.init("API_KEY");
最佳答案
您可能想检查 Google Firebase 如何进行纯客户端身份验证:https://firebase.google.com/products/auth/
编辑:使用 API key 、OAuth 等进行身份验证的一般介绍(来源:关于构建 Web 应用程序的 Codecademy 类(class))可能有助于理解 API key 的用途以及为什么不需要保护它们。原因是还有其他方法可以处理 secret 信息,如本文所述。
Authentication
INTRODUCTION
Authentication is the process used by applications to determine and confirm identities of users. It ensures that the correct content is shown to users. More importantly, it ensures that incorrect content is secured and unavailable to unauthorized users.
In this article, we’ll discuss a few of the common design patterns for these interactions. You’ll need to have some basic understanding of HTTP requests, since these methods all use HTTP requests to exchange information.
PASSWORD AUTHENTICATION
The most common implementation of authentication requires a user to input their username or email and a password. The application's server then checks the supplied credentials to determine if the user exists and if the supplied password is correct. If the credentials are correct, the user is logged in and able to use the application as thatthe user.
Typically, upon a successful login, the application will respond with an authentication token (or auth token) for the client to use for additional HTTP requests. This token is then stored on the user's computer, preventing the need for users to continuously log in.
This token generally expires after a certain amount of time, ensuring the correct user is using the application over time as well.
API KEYS
While it is common to think of authentication as the interaction between a human user and an application, sometimes the user is another application.
Many apps expose interfaces to their information in the form of an API (application program interface). For example, the Spotify API provides endpoints for almost all of its functionality. This allows applications to fetch data from the Spotify music catalog and manage user’s playlists and saved music.
Since these external requests could overwhelm a service and also access user information, they need to be secured using authentication.
The most basic pattern for API access from another application is using an API key.
Public APIs usually provide a developer portal where you can register your application and generate a corresponding API key. This key is then unique to your application. When your application makes a request, this key is sent along with it. The API can then verify that your application is allowed access and provide the correct response based on the permission level of your application.
The API can track what type and frequency of requests each application is making. This data can be used to throttle requests from a specific application to a pre-defined level of service. This prevents applications from spamming an endpoint or abusing user data, since the API can easily block that application's API key and prevent further malicious use of the API by that application.
OAUTH
For many applications, a generic developer-level API key is not sufficient. As mentioned earlier, APIs sometimes have the ability to provide access to user-level data. However, most services only provide this private data if the user enables it.
For example, Facebook doesn't want Tinder to access all of their users' data, just the users who have opted in to allowing the sharing of data to better help them find a match in their area.
A basic approach to this problem might be to have the user provide their login credentials to the intermediary application, but this is not very secure and would give full access to the requesting application, when the requesting application might only need a very limited set of privileges to function.
OAuth defines a more elegant approach to this problem. It was developed in November 2006 by lead Twitter developer Blaine Cook and version 1.0 was published in April 2010.
OAuth is an open standard and is commonly used to grant permission for applications to access user information without forcing users to give away their passwords.
An open standard is a publicly available definition of how some functionality should work. However, the standard does not actually build out that functionality.
As a result, each API is required to implement their own version of OAuth and therefore may have a slightly different implementation or flow. However, they're all based around the same OAuth specification.
This can make using a new OAuth API a little more frustrating. However, with time you will begin noticing the similarities between API authentication flows and be able to use them in your applications with increasing ease. Below is a summary of the standard OAuth flow.
GENERIC OAUTH FLOW
Many applications implementing OAuth will first ask the user to select which service they would like to use for credentials:
Login with Google, Facebook or Twitter
After selecting the service, the user will be redirected to the service to login. This login confirms the user’s identity and typically provides the user with a list of permissions the originating application is attempting to gain on the user’s account.
If the user confirms they want to allow this access, they will be redirected back to the original site, along with an access token. This access token is then saved by the originating application.
Like a developer API key, this access token will be included on requests by the application to prove that the user has granted access and enable access to the appropriate content for that user. When a user returns to the application, the token will be retrieved and they will not have to re-authenticate.
OAUTH 2
Since OAuth evolved out of Twitter, there were important use cases not originally considered as part of the specification. Eventually, this led to the creation of a new version of the specification, called OAuth 2.
Among other improvements, OAuth 2 allows for different authentication flows depending on the specific application requesting access and the level of access being requested.
OAuth 2 is still an open standard, so each API will have its own flow based on its particular implementation. Below, we’ll discuss a few of the common OAuth 2 flows and how they are used.
CLIENT CREDENTIALS GRANT
Sometimes an application will not need access to user information but may implement the added security and consistency of the OAuth 2 specification. This type of grant is used to access application-level data (similar to the developer API key above) and the end user does not participate in this flow.
Instead of an API key, a client ID and a client secret (strings provided to the application when it was authorized to use the API) are exchanged for an access token (and sometimes a refresh token). We will discuss refresh tokens in more depth later.
This flow is similar to our first example, where an email and password were exchanged for an authentication token.
It is essential to ensure the client secret does not become public information, just like a password. As a result, developers should be careful not to accidentally commit this information to a public git repository. Additionally, to ensure integrity of the secret key, it should not be exposed on the client-side and all requests containing it should be sent server-side.
Similar to the previously-mentioned keys, the returned access token is included on requests to identify the client making the requests and is subject to API restrictions.
This access token is often short-lived, expiring frequently. Upon expiration, a new access token can be obtained by re-sending the client credentials or, preferably, a refresh token.
Refresh tokens are an important feature of the OAuth 2 updates, encouraging access tokens to expire often and, as a result, be continuously changed (in the original OAuth specification, access tokens could last for time periods in the range of years). When a refresh token is used to generate a new access token, it typically expires any previous access tokens.
AUTHORIZATION CODE GRANT
This flow is one of the most common implementations of OAuth and will look familiar if you’ve ever signed into a web application with Google or Facebook. It is similar to the OAuth flow described earlier with an added step linking the requesting application to the authentication.
A user is redirected to the authenticating site, verifies the application requesting access and permissions, and is redirected back to the referring site with an authorization code.
The requesting application then takes this code and submits it to the authenticating API, along with the application’s client ID and client secret to receive an access token and a refresh token. This access token and refresh token are then used in the same manner as the previous flow.
To avoid exposing the client ID and secret, this step of the flow should be done on the server side of the requesting application.
Since tokens are tied both to users and requesting applications, the API has a great deal of control over limiting access based on user behavior, application behavior, or both.
IMPLICIT GRANT
The previous two methods cause the client secret key to be exposed, so they need to be handled server-side. Some applications may need to access an OAuth API but don't have the necessary server-side capabilities to keep this information secure.
The Implicit Grant OAuth flow was designed for this very use case. This flow prompts the user through similar authorization steps as the Authorization Code flow, but does not involve the exchange of the client secret.
The result of this interaction is an access token, and typically no refresh token. The access token is then used by application to make additional requests to the service, but is not sent to the server side of the requesting application.
This flow allows applications to use OAuth APIs without fear of potentially exposing long-term access to a user or application's information.
CONCLUSION
OAuth provides powerful access to a diverse set of sites and information. By using it correctly, you can reduce sign-up friction and enrich user experience in your applications.
关于javascript - 即使在客户端,是否有办法保护 React JS 中的 API key ?,我们在Stack Overflow上找到一个类似的问题: https://stackoverflow.com/questions/45530345/
我知道这有点愚蠢,但我需要保护 javascript,从某种意义上说,我希望增加尽可能多的安全性,以免它被盗版。好吧,因为它是系统的核心组件。我打算用YUI compressor来压缩混淆。 但我还想
因此,当我的宏运行时,我有这些简单的子程序可以解除保护而不是保护东西,唯一的问题是我的一些工作表实际上是图表,并且在调用这些子程序时它们没有得到保护。如何更改我的代码以合并图表?谢谢! Sub Unp
有很多关于 preventing CSRF 的文章. 但我就是不明白:为什么我不能只解析目标页面表单中的 csrf token 并将其与我的伪造请求一起提交? 最佳答案 如果您能够将脚本代码注入(in
关闭。这个问题是off-topic .它目前不接受答案。 想改善这个问题吗? Update the question所以它是 on-topic对于堆栈溢出。 9年前关闭。 Improve this q
我正在使用一个包含用于docker创建的敏感信息的env文件。 但问题是它们并不安全。可以通过docker inspect轻松查看它们,因此,任何可以运行docker命令的用户都可以使用它们。 我正在
NSA在此处提供了保护.NET框架2.0版的指南:http://www.nsa.gov/ia/_files/app/I731-008R-2006.pdf 我想知道他们是否提供更高版本的指南,例如版本3
我编写了一个 Java 应用程序,并计划在线发布它。每个版本都将使用我制作的 secret 序列 key 锁定。 我需要从反编译器等保护我的 jar 文件。这是我到目前为止所做的: 用户在表格中输入他
我不知道为什么这不起作用。如果 ?Session=2 不是您发出的,那么您将返回您的帐户。 这是我的代码: query("SELECT * FROM user_host WHERE uid = '"
我是 elasticsearch 的新手,但我非常喜欢它。我唯一找不到也无法完成的是保护生产系统的 Elasticsearch 。我读了很多关于在 elasticsearch 前使用 nginx 作为
假设我有以下头文件: #ifndef TESTCLASS_H #define TESTCLASS_H #include class TestClass { public: TestClass
在 C++ 中,我有一个基类 A,一个子类 B。两者都有虚方法 Visit。我想在 B 中重新定义“访问”,但 B 需要访问每个 A(以及所有子类)的“访问”功能。 我有类似的东西,但它告诉我 B 无
我目前正在使用 Apache FOP 库生成 PDF。我希望这些 PDF 免受复制粘贴,因此人们必须使用实际的 OCR 库(或手动输入)来获取 PDF 上的信息。 FOP 显然提供了一些安全性,然后将
我有一个使用 JSONP 进行跨域 ajax 调用的脚本。这很好用,但我的问题是,有没有办法阻止其他站点访问这些 URL 并从中获取数据?我基本上想制作一个允许的站点列表,并且只返回列表中的数据。我正
我在基于 Html/Javascript 构建的 Web 应用程序上使用了一些全局变量。我跨页面(或部分页面)使用这些变量,有时它们用作 ajax 调用的发布数据。我的问题是:这有多安全?当然,我可以
我有一个扩展到多个类文件的大项目。这个项目是在赶时间前匆忙完成的。这对项目安全造成了影响。所以简单来说,理论上任何人都可以在我的项目中调用一个 AJAX 脚本并让它运行,因为脚本中的函数不是用户权限感
相当多的人对 ivé 发送给他们的 dll 真正感兴趣,他们不是那种应该经常免费赠送的类型... 我只是想知道,如果我要出售我的组件、用户控件等,我将如何在所有权/加密代码(如果可能)等方面保护它们。
我正在开发一个 PHP 库,我们将在其中为客户提供加密代码。该代码将包括一个他们可以实例化的主要类,该类将处理许可证验证并公开其使用方法。主类将实例化几个子类,每个子类都包含在自己的文件中。我怎样才能
我有一个以 VUEJS 作为前端的 Laravel 应用程序,我通过创建 API 路由获取数据。因此,例如获取帖子数据的路线将是 http://localhost/api/posts 保护路线的最佳方
在许多网页上,我们都包含外部脚本。无论是类似于 Facebook 的按钮、用于分析或广告系统的客户端代码、外部评论提供商还是其他东西。 那些脚本无法访问我的 Ajax 资源,因为一直在检查原始 hea
我目前正在使用 PHP/MySQL 开发一个公开和开放源代码的软件。我在一个文件夹中有几个重要的 SECRET TXT 文件。我在软件中使用它们,但问题是它们也可以被任何知道文件夹和文件名的人读取:
我是一名优秀的程序员,十分优秀!