离线访问令牌的安全性
我创建了一个应用程序和一个离线访问令牌，这样我就可以在我的网站上显示新闻源，而无需登录 Facebook。我用 PHP 和 JavaScript 创建了两个运行良好的测试版本。但我删除了 JavaScript 版本，因为我担心在客户端脚本中显式声明访问令牌缺乏安全性。出于安全原因，服务器端是唯一的方法吗？
I created an app and an offline access token so I could display a news feed on my website without requiring a Facebook login. I created two test versions in PHP and JavaScript that work fine. But I took down the JavaScript version because I was concerned about the lack of security in explicitly stating the access token in a client-side script. Is server-side the only way to go for security reasons?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
我认为你从 javascript 中取出你的访问令牌是正确的。只要该访问令牌有效 - 即使它不是通过离线访问权限获得的 - 它就可以用于代表该用户/应用程序/页面执行操作。拨打电话所需的只是易于获取的用户/应用程序/页面 ID 和有效的访问令牌...
我建议您将访问令牌管理留给服务器端脚本。也许定期进行 ajax 调用来刷新帖子......
I think you are correct to take out your access token from javascript. As long as that access token is valid - even if it hasn't been obtained with offline_access permissions - it can be used to perform actions on behalf of that user/app/page. All you need to make calls is the user/app/page ID which is easily obtainable and a valid access token...
I recommend you leave your access token management to your server-side scripts. Perhaps making ajax calls to refresh the posts at regular intervals...