3 ms·
It is very common to see API keys in urls for access to what are essentially flat files. Thus, fairly trivial to change from: https://127.0.0.1/file.csv https
by Joel_Mckay 4y ago
It is very common to see API keys in urls for access to what are essentially flat files. Thus, fairly trivial to change from:
https://127.0.0.1/file.csv https://127.0.0.1/file.csv
to
https://127.0.0.1/file.csv?apikey=abc123 https://127.0.0.1/file.csv?apikey=abc123
This could allow client specific quotas, and easy adoption with maintained projects in minutes. Thus, defective and out-of-maintenance projects would need manually updated or get a 404.
=)
- codalan 4y agoAhhh, good point!
- Programmatic 4y agoAPI keys are most successful when they're issued for server-side use; when used client-side the usual pattern that I see is for individual clients to request their own API key? In this case, it would need to be distributed to myriad users who legitimately need to ask for the lists and then could be scraped by the "attacker", but at least then they'd have to be knowingly malicious vs. accidentally malicious.
- kevincox 4y agoYou generally add a small "cost" to request an API key. For example submit your email to this form and wait a day. Then browser makes like this will not reasonable be able to request a new key automatically for every install. So they will just request one and ship it. Then when you get abuse like this you can disable it.