YOURLS: hide signature API token in Chrome extension?

194 views Asked by At

I found this code: https://github.com/binfalse/YOURLS-ChromeExtension so I want to create my Chrome extension. This extension works by asking user to enter secret signiture. After that, user can use extension with his own signiture (that can be found in user account). I want to make extension with pre-populated signiture key because I want to make it available for use without creating account. Problem is that I can't store secret key in extension code, everyone can see it.

I tried to encode key with some obfuscator tool, but another tool can reveal that. I found this too: https://github.com/YOURLS/YOURLS/wiki/PasswordlessAPI#usage-of-a-time-limited-signature-token But I can't implement that in extension because it's PHP code.

$timestamp = time();
$signature = md5( $timestamp . '1002a612b4' );
// Replace with your own secret signature token. Example result:
// $signature = "ed8d12124fc7916b00e3ecd7dc2c1d6a"
?>```
0

There are 0 answers