7

I'm building a vue js web app and I would like to make respective calls to the to my prismic repo, but I don't know how to do it without exposing my access token. I am using the rest api approach shown here. Any ideas?

The http request syntax is as follows. I want to do this inside my vue components while not exposing the access_token.

http://your-repository-name.prismic.io/api/v2/documents/search?ref=Your_Ref&access_token=Your_Token

In my API/Security settings I'm also given a Client ID and Client Secret. I can't figure out how I can use these either.

Thanks

Marcus Gallegos
  • 1,532
  • 1
  • 16
  • 31
  • Use a `POST` request instead of `GET` request for this. This is not 100% safe as well, but it does remove the querystring that contains your access token in the address bar. – Ru Chern Chong Sep 12 '18 at 06:39

1 Answers1

7

You'd have to store your access token on your server and make it process the requests on behalf of the client.

In the end, you'd send requests to your server instead of directly to prismic.io, your server will then send the access token authorized request, fetch whatever you need and return it back in response to the client.

The work flow would look like this:

  1. Client sends request to i.e. http://localhost:8000/api/endpoint
  2. Server sends request to prismic.io endpoint associated with the above endpoint.
  3. Server gets prismic.io response and sends it back to the client.
  4. Client gets the response.

If you want to hide your access token client-side, then it's impossible. To protect your access token the other two options are:

  1. Make users use their own prismic.io access tokens.
  2. Allow access only to authorized users.

The two options above are probably not what you want, so setting up a proxy server is what's left.

dziraf
  • 3,607
  • 1
  • 16
  • 22
  • Thank you! This is what I was thinking, your work flow steps confirm my thoughts. The http://localhost:8000/api/endpoint - this could just be a javascript executable? Can you point me to any examples of what this might look like? – Marcus Gallegos Sep 12 '18 at 16:10