Hiding contentful Space id and access token, client side javascript file - Stack Overflow

admin管理员组

文章数量:1426626

I am new in contentful and I am trying to display content from contentful to a web page. I am displaying the content using contentful.js, I wanted to know How can i hide these information(space id and access token values) from public users when i am using it in a js file to display contents in a web page. Below is the Javascript code which i am using in main Js file to display the content in html file.

var client = contentful.createClient({
  accessToken: 'b4c0n73n7fu1',
  space: 'cfexampleapi'
});

client.entries()
.then(function (entries) {
  // log the file url of any linked assets on image field name
  entries.forEach(function (entry) {
    if(entry.fields.SampleContent) {
      document.getElementById('sample_content_block').innerHTML = entry.fields.SampleContent;
    }
  })
})

Thanks in advance!

I am new in contentful and I am trying to display content from contentful to a web page. I am displaying the content using contentful.js, I wanted to know How can i hide these information(space id and access token values) from public users when i am using it in a js file to display contents in a web page. Below is the Javascript code which i am using in main Js file to display the content in html file.

var client = contentful.createClient({
  accessToken: 'b4c0n73n7fu1',
  space: 'cfexampleapi'
});

client.entries()
.then(function (entries) {
  // log the file url of any linked assets on image field name
  entries.forEach(function (entry) {
    if(entry.fields.SampleContent) {
      document.getElementById('sample_content_block').innerHTML = entry.fields.SampleContent;
    }
  })
})

Thanks in advance!

• javascript
• contentful

Share Improve this question Follow asked Mar 21, 2016 at 15:03 R. ManiR. Mani 6111 silver badge55 bronze badges 1

• There is no way to hide anything in client side javascript. If this is a concern, you'd need to wrap these calls on the server (ie the node sdk) – aw04 Commented May 4, 2016 at 21:03

Add a ment  | 

2 Answers 2

Sorted by: Reset to default 5

There a few different ways that you could do this. The easiest way would be to move your space ID and accessToken into an environment variable. Take a look at this medium post on how to do that with Javascript: https://medium./ibm-watson-data-lab/environment-variables-or-keeping-your-secrets-secret-in-a-node-js-app-99019dfff716.

Then on your hosting provider, you'd be able to set the environment variable as those variables and your code would be able to utilize them.

Something interesting to note is that all the content that you put onto Contentful is assumed to be read-only. Exposing your Content Delivery API key (the access key in your example) and your space ID isn't the end of the world in a way that sharing an API Key for an alternative service can be. Using that CDA Key you posted wouldn't enable someone to edit any of the data you have stored on Contentful, just to read it.

However, you want to make sure you don't expose your CMA Key (Content Management API Key) as that would allow people to edit and change your content in Contentful.

You could use your own server (or lambda function) to proxy requests, and then keep the tokens on the server side of things, not exposed to the web.

本文标签： Hiding contentful Space id and access tokenclient side javascript fileStack Overflow