Instafeed.js: can any instagram user get their own pictures in my website?

[lansas]

Can any instagram user get their own pictures via instafeed.js to login (with instagram account) in my website?

[danstn]

Yes.

DO NOT expose your access-token on the client - anyone can get it and use the api on your behalf.

Also, the token can expire at any point.

[danfiscus]

@dzotokan The script doesn't work without specifying an access-token, so how do I protect my token?

[danstn]

You would need to generate it on every request (which requires authentication).

If it's a sandbox api client (most likely) - the data you'l be able to access with your access token will be restricted to your user's API clients only. The API is not designed for public sharing.

[dmzza]

I think the only risk in exposing your access token would be that someone could find it and use it for their own app, but if your access token has only been granted basic permissions, then they would only be able to display the 20 most recent photos from your Instagram account. I can't imagine anyone would want to do that. As long as you stay in sandbox mode, your client ID and access token are virtually useless to anybody else.

Even if you get approved for production use, as long as you only authenticate users for basic permissions, exposing their access tokens to the client wouldn't give anyone API access to information that isn't already publicly available or beyond the scope of that specific account.

With that in mind, you should never expose an access token that has anything beyond basic permissions if it is an account that you care about.

[stale[bot]]

This issue has been automatically marked as stale because it hasn't had new comments in the last 3 months. It will be closed if no further activity occurs. If you still need assistance with this issue, or believe it shouldn't be closed, please respond with a new comment to let us know.
Thank you all for your contributions.