从客户端上传文件到网络上而不泄露 API 密钥
例如，我正在尝试将文件从 Web 应用程序上传到外部源（例如 scribd）。要上传文件，我还需要发送 API 密钥。但是，如果我从客户端发送 API 密钥，它将向在客户端搜索它的用户显示。
如何使用我不想向用户透露的 API 密钥从客户端上传？将其上传到我的服务器然后再上传到外部源似乎是多余的。
I'm trying to upload a file from a web application to an external source (such as scribd) for example. to upload the file I need to send the API key as well. however if i send the API key from the client it will be revealed to users who search for it on the client side.
How could I upload from client using an API key that I don't want to reveal to users? It seems redundant to upload it to my server and then to the external source.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
尽管通过服务器可能是多余的，但这是唯一的方法。您无法在客户端使用密钥并向客户端隐藏它，如果您不使用 HTTPS，它也很容易被拦截。附带说明一下，我不了解 Scribd，但通常窃取 API 密钥并不是很有用，因此您可能只能忍受“风险”。
编辑：
显然，Scribd 提供了一种提供加密请求的方法，这样它们就无法推断出您的 API 密钥（当然，您必须远程生成这些请求并将它们发送到客户端）。请参阅http://www.scribd.com/developers/api?method_name=Signing
As redundant as it may be to pass through your server, it's the only way. You can't use the key client-side and hide it from the client, and if you don't use HTTPS it can easily be intercepted too. As a side note, I don't know about Scribd but usually stealing API keys is not very useful, so you may just live with the "risk".
Edit:
apparently Scribd offers a way to provide encrypted requests so that your API key can't be deduced by them (you have to generate these remotely and send them to the client of course). See http://www.scribd.com/developers/api?method_name=Signing