6

I would like to develop a client side javascript widget that may be included on authorized partner web sites only. The javascript widget will make REST calls back to the main website. Partner web sites should be able to use the javascript widget without installing any server side components. Any attempt by an unauthorized site to use a given key should fail. Obviously, any API keys that are delivered to a web browser would ultimately be vulnerable to exposure even if they were obscured somehow.

One real world example I looked to for ideas is the Google Maps Javascript API v3, which imposes quota limits and optionally allows API clients to restrict access for a given key to specified domains. But it looks like this restriction is based on referers, which seems too easy to forge. It seems like websites using this system are vulnerable to an attacker using their keys (which are visible in plain text in the HTML) and running enough API calls to exceed the quota. Also worth noting, is that Google distinguishes between “Browser keys” and “Server keys”.

Here are some related questions I found, none with encouraging answers:

Is there an existing design pattern, standard or cryptographic scheme that addresses this issue? Or is there no way to accomplish this without some server side component?

Community
  • 1
  • 1
Asaph
  • 159,146
  • 25
  • 197
  • 199
  • "referers, which seems too easy to forge": since anyone with the skill to forge a referer can get their own API key for free, i don't see the potential payoff or loss. you can reproxy the api with your php, which lets you authenticate users and keeps your API key secret, but that sorta defeats the benefits of a 3rd party API... dont' assume that google will let one user hammer away at their machines undaunted, until the pool quota is exhausted, there are per-client limits as well... – dandavis Jun 02 '14 at 18:06
  • In my case, the API keys are *not free*. To address your point about the potential payoff or loss, the attacker's motivation in this scenario would be denial of service on an API client's site by exhausting their quota. – Asaph Jun 02 '14 at 18:15
  • 1
    if your key is not free and you're worried about adversaries, it behooves you to reproxy everything from php to keep your valuable info private. it also gives you a chance to cache common requests and thus cut down on your over-all api key consumption, authenticate users, detect robots, etc. in short: it moves from no control to total control. i'm afraid there's not much in-between due to physics. – dandavis Jun 02 '14 at 18:21

0 Answers0