Django - How to protect web service url - API KEY

Question

I use geodjango to create and serve map tiles that I usually display into OpenLayers as openLayers.Layer.TMS

I am worried that anybody could grab the web service URL and plug it into their own map without asking permission, and then consume a lot of the server's CPU and violate private data ownership. On the other hand, I want the tile service to be publicly available without login, but from my website only.

Am I right to think that such violation is possible? If yes, what would be the way to be protected from it? Is it possible to hide the url in the client browser?

Edit: The way you initiate tile map service in OpenLayers is through javascript that could be read from client browser like this:

    tiledLayer = new OpenLayers.Layer.TMS('TMS',
                "{{ tmsURL }}1.0/{{ shapefile.id }}/${z}/${x}/${y}.png"
                        );

Its really easy to copy/paste this into another website and have access to the web service data.

How can I add an API Key in the url and manage to regenerate it regularly?

Iam not familiar with this topic, but I could imagine that there is an api available to handle your request. So you would query the service from your server and display the result to the user browser. — Jingo, Jun 06 '13 at 18:44
Very interesting! So I could change the api key in the url regularly. Do you know a good django app that can manage that? — Below the Radar, Jun 07 '13 at 12:48

score 1 · Answer 1 · answered Jun 06 '13 at 19:00

1

This may not answer your question, but there's no way to hide a web request in the browser. To normal users, seeing the actual request will be very hard, but for network/computer savvy users, (normally programmer who will want to take advantage of your API) doing some sniffing and finally seeing/using your web request may be very easy.

This you're trying to do is called security through obscurity and normally is not very recommended. You'll have to create a stronger authentication mechanism if you want your API to be completely secure from non authorized users.

Good luck!

answered Jun 06 '13 at 19:00

Paulo Bu

29,294
6
74
73

I am agree with you. Obscurity was my first idea but I suppose its not a good one. I have red something about token authentification with django, maybe thats a more viable solution – Below the Radar Jun 06 '13 at 19:03
Is a safe/better approach definitely :) – Paulo Bu Jun 06 '13 at 19:05

score 1 · Accepted Answer · edited May 23 '17 at 12:18

There's a great answer on RESTful Authentication that can really help you out. These principals can be adapted and implemented in django as well.

The other thing you can do is take it one level higher than implementing this in django but use your webserver.

For example I use the following in my nginx + uwsgi + django setup:

# the ip address of my front end web app (calling my Rest API) is 192.168.1.100. 

server {
    listen            :80;
    server_name       my_api;

    # allow only my subnet IP address - but can also do ranges e.g. 192.168.1.100/16
    allow             192.168.1.100;
    # deny everyone else
    deny              all;

    location / {
    # pass to uwsgi stuff here...
    }
}

This way, even if they got the URL, nginx would cut them off before it even reached your application (potentially saving you some resources...??).

You can read more about HTTP Access in the nginx documentation.

It's also worth noting that you can do this in Apache too - I just prefer the setup listed above.

thank you for your advice. Your solution seems to be the best to me. — Below the Radar, Jun 07 '13 at 14:34

Django - How to protect web service url - API KEY

2 Answers2