cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements
Update: Find information on Dropbox support during COVID-19 here
Close
cancel
Showing results for 
Search instead for 
Did you mean: 
Highlighted

Safely expose credentials to JavaScript client?

New member | Level 1
New member | Level 1

I'm building an application with Dropbox that allows the user to log in with Dropbox using OAuth 2. I've made an app on Dropbox, put the app key and app secret into my application code, and I can successfully authenticate the user without ever showing them my app secret, or the access token I received from Dropbox.

However, I also want to use the Dropbox API from JavaScript on my site, so that I can have the browser hit the Dropbox API directly without going through my backend as a proxy. This is especially important for uploading files to Dropbox.

I could include my OAuth access token in the HTML page I send to the user, which would allow the JavaScript to pick it up and stick it in the `Authorization` header to make API requests. However, that strikes me as insecure -- the user would be able to see my access token, which I thought was supposed to be secret. Is this the correct way of doing this, or is there a better way I can allow the user's browser to make API requests to Dropbox?

3 Replies 3
Highlighted

Re: Safely expose credentials to JavaScript client?

Super User II
Super User II

*moves to API forum*


 


- - -


Heart Did this post help you? If so please mark it for some Kudos below. 


 Did this post fix your issue/answer your question? If so please press the 'Accept as Solution' button to help others find it.


 Did this post not resolve your issue? If so please give us some more information so we can try and help - please remember we cannot see over your shoulder so be as descriptive as possible! 


 

Highlighted

Re: Safely expose credentials to JavaScript client?

Dropboxer
Dropboxer

Hi David, it sounds like you have a good handle on this already. In order to make an API call, the client (in this case, the browser) needs the access token. Fundamentally though, client-side apps, (such as in a browser) can't keep secrets. 

That means that the access token would be exposed to the users, compromising your account. Unfortunately, there isn't a good way to do this without proxying the requests through your server. (And just to be clear, this is only a problem in the case where you only want to connect to your own account for all users. In the normal case, where users only connect to their own accounts, this is fine since they'd only have their own access tokens anyway.)

Highlighted

Re: Safely expose credentials to JavaScript client?

New member | Level 1
New member | Level 1

Great! I wasn't sure if I would need to do some sort of special Javascript authentication, but I guess not. Thank you!

Work Smarter with Dropbox

The way we work is changing. Share and discover new ways to work smarter with Dropbox in our community.

Sound good? Let's get started.
Who's talking

Top contributors to this post

What do Dropbox user levels mean?
Need more support?