4 ms·
I'm not sure I understand how some of these are being used, specifically whether they're being used safely. API keys usually exist for preventing abuse. By exp
by tlrobinson 15y ago
I'm not sure I understand how some of these are being used, specifically whether they're being used safely.
API keys usually exist for preventing abuse. By exposing an authenticated API proxy you're allowing anyone to abuse someone else's API using your key, likely leading to them banning you. At a minimum you should implement your own rate limiting.
Likewise, with a JSONP proxy you're allowing other sites to circumvent the browsers' same origin policy to access that API, which could also lead to abuse. At a minimum you should restrict requests to ones with a recognized HTTP Referer header.
Of course with JSONP you also need to trust that the API isn't doing anything malicious, like injecting cookie or other data-stealing JavaScript instead of valid JSON. It would be a good idea to validate that the response is indeed JSON before passing it back to the clients (actually a properly restricted sanitizing JSONP proxy would be a good idea even if the API already provides JSONP)
So use these techniques cautiously...
- gnubardt 15y agoAPI keys usually exist for preventing abuse. By exposing an authenticated API proxy you're allowing anyone to abuse someone else's API using your key, likely leading to them banning you. At a minimum you should implement your own rate limiting. The article describes how to set up caching in nginx, so not every request to nginx goes to the external service.
- tdfx 15y agoThe potential for abuse remains.
- RyanKearney 15y agoThen don't use it. As someone who has never had much experience dealing with Nginx I found this article to be very informative. Most people are smart enough not make public their third party apis. Those who aren't will quickly learn of the problems this may have. However, there are some cases where this could be extremely useful, such as an intranet.
- tdfx 15y agoI agree the article is very informative and taught me a number of things I didn't know about nginx. Unfortunately letting people learn the hard way tends to not work out well when it comes to security.
- mnutt 15y agoAlso, your API key may be at risk if you append it to a URL that you proxy. For instance, we're doing this proxying with Tumblr (sans API key, fortunately) and they occasionally issue a 302 redirect and tack on some parameters. (for caching reasons, I assume) The 'Location' header that is sent back would have your API key in it, so you'd need to detect that and strip it out. Also, if they throw a 500 error they may echo your URL back at you. I'd probably move this code up into this application layer unless you're very sure about the API you're using.