Safely expose credentials to JavaScript client?

[David B.37]

I'm building an application with Dropbox that allows the user to log in with Dropbox using OAuth 2. I've made an app on Dropbox, put the app key and app secret into my application code, and I can successfully authenticate the user without ever showing them my app secret, or the access token I received from Dropbox.

However, I also want to use the Dropbox API from JavaScript on my site, so that I can have the browser hit the Dropbox API directly without going through my backend as a proxy. This is especially important for uploading files to Dropbox.

I could include my OAuth access token in the HTML page I send to the user, which would allow the JavaScript to pick it up and stick it in the `Authorization` header to make API requests. However, that strikes me as insecure -- the user would be able to see my access token, which I thought was supposed to be secret. Is this the correct way of doing this, or is there a better way I can allow the user's browser to make API requests to Dropbox?

[Mark]

*moves to API forum*

[Greg-DB]

Hi David, it sounds like you have a good handle on this already. In order to make an API call, the client (in this case, the browser) needs the access token. Fundamentally though, client-side apps, (such as in a browser) can't keep secrets. 

That means that the access token would be exposed to the users, compromising your account. Unfortunately, there isn't a good way to do this without proxying the requests through your server. (And just to be clear, this is only a problem in the case where you only want to connect to your own account for all users. In the normal case, where users only connect to their own accounts, this is fine since they'd only have their own access tokens anyway.)

[David B.37]

Great! I wasn't sure if I would need to do some sort of special Javascript authentication, but I guess not. Thank you!