How does one implement a browser single-app JS client (Backbone, Angular etc) to access server API with HMAC authentication? The secret key will be exposed clearly in the JavaScript client.
Unless you can use per-user keys (for example, if you control the server API) you basically can't do it. This is the same problem that DRM faces: you can't give the user the keys to the car and prevent them from driving it.
Comments
How does one implement a browser single-app JS client (Backbone, Angular etc) to access server API with HMAC authentication? The secret key will be exposed clearly in the JavaScript client.
Unless you can use per-user keys (for example, if you control the server API) you basically can't do it. This is the same problem that DRM faces: you can't give the user the keys to the car and prevent them from driving it.
Wow, that's a great analogy. I will use that next time I have to explain the flaws of client side security to somebody.
You give it an API key with limited access