0

When I create an api key, there is an option like this:

1

To make this key becomes private, I'd entered localhost:44397.

But the problem is: the request which will use the key doesn't start with localhost:44397.

It looks like:

https://www.googleapis.com/plus/v1/people/{userId}?fields=image&key={api_key}

So, I cannot use the key for this request.

Another option: if I select None for Key restriction, that means the key is public. That's not my goal.

My question: How can I use this key as a private key?

Thank you!

  • Are you confusing two things? One is authenticating the request from the client, the other is whitelisting what clients the server will accept requests from. – ficuscr Sep 14 '17 at 18:56
  • @ficuscr Yes, man. You have any idea for the things? –  Sep 14 '17 at 18:59

1 Answers1

0

The optional "Accept requests from these HTTP referrers" is a "whitelist" of the HTTP referers that the Google API will accept requests from. So, if you wanted only your site to be able to make requests using your API key you would add your website there, as shown *.mysite.com/* would mean Google would accept any request that originated from the mysite.com domain or subdomain.

The API key you need to include as part of your request to the Google API is considered public. People would see it in the URL that is the image source (I am making an assumption here on how you use it).

So you want to restrict how your public key is used by saying it can only be used in conjunction with requests that originate from a specific domain.

But can't the referer be spoofed? There is a very good Q/A here on the topic: How does Google Maps secure their API Key? How to make something similar?

ficuscr
  • 6,975
  • 2
  • 32
  • 52
  • Thanks, the request is sent from my site but the url is `https://www.googleapis.com/..........`. So, I cannot enter it. If I enter `mysite.com/*`, the request `https://www.googleapis.com/.......` would return `403` –  Sep 14 '17 at 19:17
  • What is the domain name of your site? The `googleapis.com` has NOTHING to do with the *Key Restriction* area. – ficuscr Sep 14 '17 at 19:19
  • Right, so that would work for me because you have no HTTP referer key restriction so having stackoverflow.com be the referer is not a barrier. If you want to "restrict" it (what you are calling *make private*) then setup a domain restriction. – ficuscr Sep 14 '17 at 19:26