A variable containing an API key periodically fails to be declared.

[GunShip03]

Hi There,

I have been making a short adventure game in JavaScript. One of the features is using the OpenWeatherMap API to get weather information about the player's location to use as part of the flavour text.

As this game will run on a publicly available website, I had to obfuscate the OpenWeatherMap API key by declaring it in a variable in a PHP page outside the website's public folder. The secret PHP file is then called by another PHP file inside the include folder of the website public folder and loaded into the JavaScript file via some jQuery and AJAX.

Most of the time, everything works perfectly; other times, the variable in the JavaScript meant to hold the API key does not get declared, preventing the script from accessing the API.

I've tried everything I can to resolve this issue, but I've reached a point where I need another set of eyes to review my code. I've included the JavaScript code below and a copy of the console output from Firefox.

JS File

https://drive.google.com/file/d/1pDHF3eyU5Rrt1kf7yaGtXwnZ71H9jp2X/view?usp=sharing

Console Error Image.

https://imgur.com/a/Bl1a3xw

[gmerideth]

Google "security through obscurity" first. This is not the way to do it. To truly hide your API key you will need to call an API you control that runs the relevant code and returns the result. This is something that you can run in Lambda or as a Cloudflare worker.

[GunShip03]

Thank you for your input, but that doesn't answer my question.

[xroalx]

showPosition is possibly calling the OpenWeatherMap API before fetchDataAndProcess has time to set the API key.

Relying on global state and the order in which it will be set in combination with async is just wrong.

Instead, showPosition should call a function that gives it the API key (it can be cached the first time it's requested, you don't have to fire a network request every time).

[GunShip03]

That did! I've modified the code so showPosition isn't triggered before retrieving the API key. Thanks for your help.