Hi I’m writing a pretty simple little instagram plugin that allows you to embed your photos in to a webpage. In order to display a users feed I need to get an access token for that user. I have this all setup and can display a user feed using the access token give by instagram.
I order to get the user to add the embed to there webpage I’m displaying a bit of javascript for them to use on there site. This bit of script includes there OAuth access_token. Is this ok/ secure to do. If someone looked at the users site the access token would be in plain text. In some places I’m reading that it’s not a problem unless your displaying the secret with it and the other say to never display the access token even if it is by itself? Any suggestion is it ok to display the token?
On further reading it appears as though this is a bad idea and may allow someone to delete comments or randomly like photos. back to the drawing board.