7 ms·
I committed my google maps api key to a public github repository recently and github immediately sent me a warning about it. The thing is, I did it intentionall
by bonestamp2 4y ago
I committed my google maps api key to a public github repository recently and github immediately sent me a warning about it. The thing is, I did it intentionally. The key is used on my website and the website is served by github pages.
Now, it's an embedded maps api key, there's no cost to use it, nobody can use it from a domain other than mine, and it's easily visible in the page source if someone views that, so there's really no reason not to commit it since even if I didn't commit to somewhere publically, it's still publicly available on my website and nobody else can use it anyway.
Is this a reasonable exception to this rule?
- tomschwiha 4y agoI just wondered what happens if you spoof locally the domain name. Could you still use the api key?
- bonestamp2 4y agoMaybe. Thankfully there's no cost to use the key if someone does it.
- prepend 4y agoI could run your site locally with a customized host file so the referers all come from your domain. I don’t think it’s that much of a risk but I wouldn’t want to use a key associated with something that can bill me. You could use Google actions to build your pages site injecting the api key at build time. It’s stored a repo secret rather than in code. Of course since you deploy the site publicly, the key will still be visible.