My client-side JavaScript program needs to make HTTP posts to a service that requires POST data to be signed by my private "secret" according to the HMAC-SHA512 method. I have the "secret", but I cannot find JavaScript code/library to perform this signing.

Does anyone know how to accomplish this in the browser? I'm trying to avoid adding the complexity of adding a server-side component, which would use the Node.js crypto package e.g. crypto.createHmac("sha512", api._apiSecret).update(queryString).digest("hex").

  • 1
    Is this client side javascript program only going to be distributed to "trusted" users? If not and you use javascript to cryptographically sign your POST request then you are completely defeating the security that the request signing is giving you and anyone who has access to your javascript program will be able to see the private key and make legitimate requests with it. – Alex Urcioli Dec 20 '16 at 1:50

There are many client side librarys out there, that are able to create HMAC signatures (google can help you here). For example jsSHA, which can also be found on cdnjs. Explainations on how to use the library can be found on the github page.

But keep in mind, that when you share your API secret with the client, be it hard-coded in your javascript file or with a request to your server, the client can extract the secret and use it for other requests. These request could violate the terms of service of your provider or simply use up your quota. To prevent this abuse, you should either create the hash or preform the whole request on the server side and share the results with the client.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.