The Movie Database qoldaýy
Qoldaý → API qoldaýy
API Key and JavaScript
posted by lucrusSTAFFMOD on 2017 Qańtar 28 at 3:26 AM
I'm developing a little website that makes use of TMDB data. It should let users search the TMDB database with a JavaScript function, but that would require me to send the API key to the browser, making it ultimately available to anyone, and I'm concerned about security. Is it a common practice for TMDB JavaScript clients to hold the API key? Are there any better practices for TMDB JavaSript development?
Travis Bell jaýaby
2017 Qańtar 28 kúni 11:04 AM ýaqytynda
Yes, there's not going to be much you can do. We don't worry too much about this. Since we offer our service for free, there really isn't much of a reason to steal someone else's key. Having said that of course, if you feel like your key was stolen and has activity on it that isn't yours, we can always shut it down and issue another.
lucrus jaýaby
2017 Qańtar 29 kúni 5:02 AM ýaqytynda
In this case, from your point of view, you have a rate limit in place, so the worst you can face is a key revocation and issue of another one. From my point of view, it would be a DoS. I think I'll move the TMDB code on the server and provide my clients with my own webservices then. Thanks for the help.