Jonathans stuff

We’ve been asked about this a few times: How can I run YQL from javascript with all this oauth stuff, I just want it to work!?

For real day-to-day use, the answer is you shouldn’t as any Javascript only technique inevitably exposes your shared secret. As with most secure APIs you should go via your own proxy to do the signing (use the PHP SDK or any other oauth library).

However, its still useful to “get going” and try things out away from the console and my colleague Paul has created some simple sample code for executing 2-legged oauth queries from javascript that enables you to call YQL functions without needing a server. Its as easy as:

var originalUrl="http://query.yahooapis.com/v1/yql?q=show%20tables&output=json";
var signedUrl = makeSignedRequest("[API Key HERE]","[Shared Secret HERE]",originalUrl);

For the most part you’ll probably be doing this using script node includes, so you probably want to add the callback parameter to the original url you want signing (you cannot add it afterwards as that will change the URL signature and invalidate the signed Url you have). You’ll also be exposing your shared secret, so you should only use this for testing and prototyping because if someone else copies it, you’ll need to get another one.

Note: the example is only 2-legged oauth. This lets YQL verify who the application is that’s using it, but not who the user is (which would be 3-legged). So it doesn’t bounce the page viewer anywhere (your users won’t even be aware of using YQL) and only allows the application access to public data. Thats still a lot of data, and enables you do some pretty powerful stuff

So check out his recent post.

October 31st, 2008 | Tags: 2-legged, 3-legged, javascript, oauth, scriptnode, signing, yahoo, YQL | Category: YQL, ajax, javascript, mashup, scriptnode, yahoo | Subscribe to comments | Leave a comment | Trackback URL