PDA

View Full Version : Security of Nickname & Key

rbottoms
Jun-12-2007, 05:29 PM
Is there are way to use an ecrypted version of our Nickname and Key in JavaScript & HTML when using the API?

I am uncomfortable providing such info in the clear.
devbobo
Jun-12-2007, 05:41 PM
Hi rbottoms,

Can you please give me a bit more information, I am not sure that I fully understand what you are asking.

Cheers,

David
rbottoms
Jun-12-2007, 05:55 PM
Sure:

<snip>
var nickname="yourname"; //your smugmug nickname


document.write('******** src="http:\/\/api.smugmug.com\/hack\/json\/1.2.0\/?method=smugmug.albums.get&amp;SessionID='+sess_id+'&amp;N ickName=yourname&amp;JSONCallback=getit2"><\/********');

******** type="text/javascript" src="http://api.smugmug.com/hack/json/1.2.0/?method=smugmug.login.anonymously&amp;APIKey=1234YOURK EY7890&amp;JSONCallback=getit"></********




r.b.
devbobo
Jun-12-2007, 06:10 PM
Hey r.b.,

Thanks for that. No there isn't really anyway to encode that...but perhaps you could obfiscate it, by using url encoding on those two parameters.

Let me know if you need help with that.

Cheers,

David
<snip> </snip>
GarethLewin
Jun-12-2007, 09:34 PM
Who do you want to hide the info from?

<!--********</p-->

If you are worried about sniffing, then note that you can use https:// connections, which are encrypted.

If you want to hide them from the script, then don't store them in the script. Not sure the exact usage of your script so can't advise more than that.