3 ms·
Any API that uses some form of authentication token that is not obtained via some user-based interaction like OAuth may need to be at least proxied via a server
by kodablah 13y ago
Any API that uses some form of authentication token that is not obtained via some user-based interaction like OAuth may need to be at least proxied via a server side piece to prevent exposing credentials/keys.
- nl 13y agoErr.. why? Clearly the keys need to be obtained somehow, but that was out of band for my application. Once they are obtained I don't see any reason why passing them from a 3rd party app over HTTPS (using CORS) is any less secure than using session based authentication with a 1st party app. In both cases you are vulnerable to MTM and XSS attacks. Sessions expire which is nice, but that's the only real difference.