There is a lot resources about how to secure REST API access, but this not what I am looking for. I am going to use provided REST API with Basic Authentication (and this cannot be changed easily :( ).

Obviously I can go with:

var requestOptions = {
    hostname: "rest.api.url",
    path: "/path/",
    auth: "username:password"
};

var req = http.request(requestOptions, function (res) {
    // some code here
    });

Is there a way to not provide password in plain text in the script?

There is a lot resources about how to secure REST API access, but this not what I am looking for. I am going to use provided REST API with Basic Authentication (and this cannot be changed easily :( ).

Obviously I can go with:

var requestOptions = {
    hostname: "rest.api.url.",
    path: "/path/",
    auth: "username:password"
};

var req = http.request(requestOptions, function (res) {
    // some code here
    });

Is there a way to not provide password in plain text in the script?

• javascript
• rest
• restful-authentication

2 Answers 2

Is there a way to not provide password in plain text in the [JavaScript]?

Client-side JavaScript will always be vulnerable to tampering and modification, including reversing any "encrypted" passwords you store in the client-side script. You can obfuscate your code all you like, but if the password is present in any form in your client script, it is accessible.

I am going to use a provided REST API with Basic Authentication (and this cannot be changed easily

Since you can't change the REST API to use something like tokens or SSL, one solution that es to mind is to have an intermediary between your server and the REST API which does use SSL. Communicate securely with some server-side script on your server, and have this script proxy the requests and responses from the REST API.

Resources:

• How to encrypt data in javascript and decrypt in php?
• Secure munication between JavaScript and a Web service in PHP
• How to secure the password while it being sent using AJAX?

You can encode it with whatever encryption you like, however your encryption technique will still exist on the client side. The proper thing to do here is to setup a SSL certificate so that your requests bee encrypted with the certificate.

Furthermore, to reduce the need to send passwords around you may want to look at using some sort of token based authentication.