I have a theme component where it sends a request to an external API to fetch some data during a page load. However, the Bearer token I use to fetch this data is naturally loaded in the script that the client has access to. Is there a way to create a plugin or something that will enable me to hide t…

Yes, you should indeed create a plugin, and define a controller method that fetches the data for you. Then, from the frontend code, call the controller method, which injects the bearer token server side, inaccessible for any third party, and makes the call to the external API.

[图片] Richard - Communiteq: you should indeed create a plugin, and define a controller method that fetches the data for you. Rather than creating a new controller to do it (which isn’t clearly what Richard recommended) you can fairly easily add it to an existing serializer, something like a…

I think it’s a very bad idea to hook an external dependency into a serializer @pfaffman If the external service goes down or is slow, then your forum will be down as well.

Oh. Well, darn. That does sound true. :person_shrugging: @attj , this is one of many matters in which I trust what Richard says more than what I say. I’m afraid you’ll need to do the work to add a route and such, which is quite a few more lines of code ( probably only dozens). I think that Discour…

I guess I managed to write a plugin but I need to put it to github in order to include it in my app.yml. Which naturally exposes the token as well. Is there a way to get around this?

Just read the token from a site setting and input it there after installation.

在主题组件中隐藏 API 令牌

支持

RGJ (Richard - Communiteq) 2022 年9 月 5 日 16:53 4

我认为将外部依赖项挂钩到序列化程序是一个非常糟糕的主意 @pfaffman
如果外部服务出现故障或运行缓慢，那么您的论坛也将无法使用。

话题		回复	浏览量
Hiding the API Key Development	3	644	2020 年6 月 17 日
Is a theme component or plugin best for external API calls? Development	4	227	2025 年4 月 30 日
Can I expose a route with no authentication? Development	12	1737	2020 年9 月 14 日
Display a value from an external webservice in the header Development	3	530	2023 年4 月 2 日
Skip "Authorize application access" Development rest-api	5	767	2020 年10 月 21 日

在主题组件中隐藏 API 令牌

相关话题