How to secure an API key in a Google chrome extens

问题:

I'm working on a Google chrome extension that basically hits our API to do a search and lists the results. We'd like the extension to have elevated API privileges (i.e. so it has access to data a regular user doesn't, and doesn't have the usual 200/requests a day limit), but we're not sure how to secure the API key used by the extension. A user can easily use the developer tools included in chrome to view the extension source (since it's just HTML, CSS and javascript) or watch the API requests as they are made and extract the API key from that.

Anyone got an idea of how we can secure an API key in a chrome extension? I've perused the google chrome extension documentation to see if there is anything that may help us but I haven't found anything.

Thanks!

回答1:

If your extension can send requests to your server, any user can use Fiddler to examine the requests and impersonate the extension.

There is nothing you can do about that.