javascript - Angular and secret keys - Stack Overflow

admin管理员组

文章数量:1425932

I have been learning angular 2 and have been doing research on how to protect data within my app.

How, if possible, can you obstruct data from the front end of the app? Is it possible to serve the angular app through a node server, say using Universal Angular, which would mean variable values can be hidden from the user on the front end.

I am essentially looking for the solution of hiding private keys which will give the app access to various APIs/creating auth headers/paths. I've read a solution is to have an API bridge for the app - so I would connect to that to retrieve the data/keys - but then how do I protect that from access? Since that endpoint would then be exposed and could be abused, or if getting keys the response is visible. The idea of locking down to domain I have read is unreliable due to spoofing and locking to IP wouldn't work as its front end or through an app?

I feel there is a glaringly obvious answer that I am missing something.

I have been learning angular 2 and have been doing research on how to protect data within my app.

How, if possible, can you obstruct data from the front end of the app? Is it possible to serve the angular app through a node server, say using Universal Angular, which would mean variable values can be hidden from the user on the front end.

I am essentially looking for the solution of hiding private keys which will give the app access to various APIs/creating auth headers/paths. I've read a solution is to have an API bridge for the app - so I would connect to that to retrieve the data/keys - but then how do I protect that from access? Since that endpoint would then be exposed and could be abused, or if getting keys the response is visible. The idea of locking down to domain I have read is unreliable due to spoofing and locking to IP wouldn't work as its front end or through an app?

I feel there is a glaringly obvious answer that I am missing something.

• javascript
• node.js
• angular

Share Improve this question Follow edited Sep 1, 2017 at 7:39 rjdkolb 11.9k1313 gold badges7777 silver badges9292 bronze badges asked Nov 23, 2016 at 11:57 Damien WalshDamien Walsh 12711 gold badge22 silver badges77 bronze badges

Add a ment  | 

2 Answers 2

Sorted by: Reset to default 3

You must assume that everything that is held in your frontend is visible to anybody that can access your frontend. All JS variables, storage (local, session), network requests, etc. in your front end are unsecured from users of your frontend.

You can (and should) use SSL to make hide data from anybody in between your server and the browser, but there is just no way to secure data held in your frontend from users of your frontend. (At least if your frontend is available on "regular" browser as opposed to some tightened kiosk mode installations.)

It's simple, when the server sends the data as response to a request, then the data can be accessed from the outside. If you don't want that, then don't send the data.

You didn't mention what problem you actually try to solve. For API keys you can for example do the request to the API on the server and provide an API on your own server for your clients and then make the server forward the requests to the actual API server.

本文标签： javascriptAngular and secret keysStack Overflow