0

Read thru a lot of posts and articles on how people handle api keys. I think some made it secure to get api keys via Node Server, some store it at .env file.

Sample posts I've read

  1. https://www.rockyourcode.com/secret-keys-in-react/
  2. https://github.com/react-boilerplate/react-boilerplate/issues/1744#issuecomment-303112505

My situation:

Currently I'm storing my API KEYs in .env files, because I'm uglifying my code in React. Those files are unreadable even via Inspect Element, but now all my api keys are exposed in readable format.

My use case:

My website don't require sign in, hence no authentication needed. Basically it's API KEY for firebase analytics. I don't think it make sense to create a Node Server to get the api key here? (And again, I don't need authentication)

How can I better handle the API KEYs?

Tommy Leong
  • 2,509
  • 6
  • 30
  • 54
  • 1
    Does this answer your question? [Is it safe to expose Firebase apiKey to the public?](https://stackoverflow.com/questions/37482366/is-it-safe-to-expose-firebase-apikey-to-the-public) – Juan Marco Jun 05 '20 at 16:41
  • 1
    Thanks Juan for sharing the link. It helps me to understand that exposing the config is not a security risk (with proper security rules), appreciate! In my case, I do not use CloudFirestore/CloudStorage/RealtimeDatabase.. hence security rules does not really matter with me I think as I have stated Im using for firebase analytics. Thanks again! (: – Tommy Leong Jun 06 '20 at 09:30

1 Answers1

0

I don't think exposing the Firebase key is a security threat as per this article: https://medium.com/@paulbreslin/is-it-safe-to-expose-your-firebase-api-key-to-the-public-7e5bd01e637b

GCP usually allows you to restrict api keys by domain. That maybe one way to secure your config and prevent other people from spoofing requests as your project.

In any other situation however, I would not expose api keys in client-side code and have an intermediate server or a cloud-function that uses it instead.

iamaatoh
  • 758
  • 5
  • 12
  • Thank you for sharing the link restrict api keys by domain, this is exactly what I've missed out. For others who wan to find out more can read this link here. https://developers.google.com/places/web-service/get-api-key#restrict_key – Tommy Leong Jun 06 '20 at 09:29