I'm having an issue and I'm pretty sure I'm not the first on that. I'm hoping to have a few great ways, hopefully bulletproof, to avoid any issues, so here it is.

I provide an API that converts HTML to PDF via a POST request. When my customer does the conversion, they provide an API key to authenticate them. So far so good.

I'm thinking of offering a way to allow those customer to do the conversion directly from within the browser of their client, in Javascript.

Now, this is possible by doing a Javascript XHR POST request including that API key, but the big security issue here is that their API key is exposed to the public and thus can be abused.

My question is simple :

How can I offer the possibility to convert documents directly within the browser without compromising their account through the API key?

My best idea so far is to allow my customer to create multiple API key, and have a statistics about how many conversions were done from that key. Moreover, they could indicate which domain works for that key, restricting the usage to a specific (set of) domain(s).

But I know that this is not bulletproof as any coder can spoof the "host" value on a request, and bypassing this "security".

How can I increase the security while offering the frontend capability?

Thanks for your help!

  • 1
    How does using the API key in Javascript using XHR exposes the key more than your existing use of the API key? – Steffen Ullrich Sep 7 '18 at 10:21
  • 1
    Currently, the user doesn't use javascript, but a backend call to my server, that's why. So the API key is not exposed. – Cyril N. Sep 7 '18 at 12:03
  • To quote from your question: "When my customer does the conversion, they provide an API key to authenticate them." - I understand from this that the customer is already using the API key, not in an XHR resulting in a POST but in a POST nevertheless. So it is in my opionion no less exposed than it would be when using XHR. – Steffen Ullrich Sep 7 '18 at 12:19
  • Maybe I'm not clear. When doing a POST request from the server, the API key is not shown to the client (my client's client). But if my customer does that request on the frontend, the client's client will be able to see the API key. That's the difference. – Cyril N. Sep 7 '18 at 17:26
  • So, currently there is no authentication of the client (i.e. your client's client) done at all? Maybe you could add more details to your question on how the current and the intended setups should look like and where currently authentication happens and where do you want it. Especially the details about the customers client are not really clear to me. – Steffen Ullrich Sep 7 '18 at 17:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.