3

I've been playing about with Chrome extensions and one of the things I'd like to do is request product information from the Amazon Product Advertising API. The code to do this is pretty straight forward but so far the only way I can find to access the API is to create a signed request which involves using your AWS public and secret keys. Unfortunately this would mean embedding my AWS keys in the Chrome Extension which would allow anyone to access them so this is obviously a no go.

Does anyone know if the API can be accessed without including my secret key? Has anyone done this using Javascript (and in particular from a Chrome extension that allows me to get ignore the same origin policy).

Roarster
  • 804
  • 1
  • 8
  • 13
  • May I ask how did you manage to make a call to AWS resources? I'm not able to do a simple `describeInstances`. Can you please take a look at this? https://stackoverflow.com/questions/54869190 – Rad Feb 26 '19 at 07:39

2 Answers2

7

Looking into this it really seems like this can't be done directly from Javascript without potentially exposing your secret key. The only options I've discovered are:

  1. Host a server to do the work for you and talk directly to your server using Javascript
  2. Use a hosted service that will do the signing for you. One example I've found is http://apisigning.com/service.html - basically for a fee they appear to sign the request for you. Note that I haven't tested this.

Sadly, I think both of these options are a bit more than I'd planned on using so I've given up on my extension for now. It's a bit disappointing that Amazon don't allow easier access to their data but I guess they feel they have to protect it from competitors.

Roarster
  • 804
  • 1
  • 8
  • 13
2

I guess you need a server to do your request! Lets the extension send the resquest to your server and there the request to amazon is done (php). The result of that you can use in your extension!

Felix Weber
  • 518
  • 1
  • 4
  • 8