4 ms·
TLDR don't share a private api key on the client side and also, don't conflate CORS with keeping secure information secure.
by ricardo81 5y ago
TLDR don't share a private api key on the client side and also, don't conflate CORS with keeping secure information secure.
- shankr 5y agoSorry bit of noob here with all these web security element. What does it mean to share API key on client side? Is it same as passing the header based authorization for client? API keys are something like JWT?
- ricardo81 5y agoYou don't want to share security credentials in source code on a web page, that is effectively sharing the credentials with the rest of the world.