Azure AI Speech
An Azure service that integrates speech processing into apps and services.
1,392 questions
Check below link
How to hide subscriptionKey and speechRegion for JavaScript integration with Microsoft Azure Speech services
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(291.2, 22%, 38%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ESM%3C/text%3E%3C/svg%3E)
Shahrukh Mateen
31
Reputation points
Is there an efficient way to hide the the subscriptionKey and speechRegion attributes for a JavaScript based integration with Azure Speech to Text services.
I am using Java/Spring based framework for my web application at server end, and AngularJS for the client-side.
I would also like to know what is the industry standard for such an integration. I am looking for a JavaScript based integration as it would speed up the asynchronous speech recognition in place of an additional REST API call to the server if I go for a Java-based integration. Also, Java-based integration requires Java 8 and up and I need to stick with Java 7 for my application.
Azure documentation: JavaScript Quickstart
P.S: By hiding the attributes, I mean the key values are not visible if someone tries to inspect the JS file in the browser.
{count} vote
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(22.400000000000002, 11%, 12%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ERM%3C/text%3E%3C/svg%3E)
Ramr-msft 17,616 Reputation points2020-07-31T07:07:35.47+00:00 @Shahrukh Mateen Thanks for the question. Please follow the below guidance to create an environment variables.
https://learn.microsoft.com/en-us/azure/cognitive-services/cognitive-services-apis-create-account?tabs=multiservice%2Cwindows#configure-an-environment-variable-for-authentication and
JavaScript: Added Speaker Recognition support for browser. -
Shahrukh Mateen 31 Reputation points
2020-08-04T13:35:49.027+00:00 Hello, Thanks for your response.
I could not understand how setting environment variables would help in hiding the subscriptionKey and speechRegion on the client's browser. -
Ramr-msft 17,616 Reputation points
2020-08-05T05:42:14.557+00:00 @Shahrukh Mateen Thanks for the details. doing this in Javascript is not a good idea, because Javascript doesn't provide a good method to protect your secret, and doesn't allow you to easily set the http headers. Our recommendation is to obtain the access token on your server via SSL (using C#, PHP, or other server scripting language) and only transmit the access token embedded in the Javascript to the client. The client then uses the access token in its calls.
Please follow this quick start to Recognize speech in JavaScript on a Web Browser.
https://github.com/Azure-Samples/cognitive-services-speech-sdk/tree/master/quickstart/javascript/browserPlease follow the front end java script samples for cognitive services.
https://github.com/Azure/azure-sdk-for-js/tree/master/sdk/cognitiveservices -
Shahrukh Mateen 31 Reputation points
2020-08-06T10:51:05.697+00:00 Hello ramr-msft, Thanks for your response.
Yes, I guess there isn't a very efficient way to completely hide the secret keys in JavaScript.
I tried the suggested authorization/access token approach to be used in the JavaScript-based integration by calling a custom server-side API which makes a call to:
"https://" + serviceRegion + ".api.cognitive.microsoft.com/sts/v1.0/issueToken"
with my
subscriptionKey.As I can check here, the Authentication tokens are valid for 10 minutes only.
Will I be needing to refresh the token every 10 minutes?
Is there a limit on the no. of tokens that can be issued to a subscriber per day? Are there any other restrictions?Also, this token would still be visible in the browser console, can this be **misused in any form?**
-
Shahrukh Mateen 31 Reputation points
2020-08-19T06:53:16.127+00:00 Hello ramr-msft,
Please update.
-
Ramr-msft 17,616 Reputation points
2020-08-19T08:28:04.82+00:00 @Shahrukh Mateen Thanks for the details. Please raise an azure support ticket to work with an engineer or You can raise an issue in the following link to work with product team to refresh authorization tokens automatically.
Yes, Authorization tokens only have a limited lifetime.Javascript Sample for the Speech SDK to create a speech to text https://github.com/Azure-Samples/cognitive-services-speech-sdk/tree/master/quickstart/javascript/browser.
Sign in to comment
1 answer
Sort by: Most helpful
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(284.8, 54%, 37%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EDJ%3C/text%3E%3C/svg%3E)
Destin Joy 1,866 Reputation points2020-07-31T13:22:10.45+00:00 -
Shahrukh Mateen 31 Reputation points
2020-08-04T13:41:37.507+00:00 Hello, Thanks for your response.
The proposed approach requires an additional REST call to the server side.
Is there not an accepted/recommended approach to achieve this?
How do the subscribing applications ensure that their keys are hidden in case JavaScript-based API integrations?If there is no way to hide/protect the
subscriptionKeyandspeechRegion
then why are JavaScript-based API integrations recommended in the first-place?
Sign in to comment -