3 ms·
Question: how are you protecting those API keys? I'm reluctant to enter mine into what could easily be an API Key scraper.
by rexreed 3y ago
Question: how are you protecting those API keys? I'm reluctant to enter mine into what could easily be an API Key scraper.
- z991 3y agoThe entire thing is frontend only (except for the share feature) so the server never sees your key. You can validate that by watching the network tab in developer console. You can also make a new / revoke an API key to be extra sure.
- jquery 3y agoPlease make a new API key folks. There's a lot of tricks to scrape a text box and watching the network tab isn't enough for safety.
- gardenhedge 3y agoWho could scrape the text box in this scenario?
- wise_young_man 3y agoChrome extension malware.
- jquery 3y agoGood luck spotting it if it's attached to the window.onclose event. Chrome extensions could save it to storage. Probably even some chrome vulnerabilities (it would just be a devtools network tab bypass so not technically a 0-day). And that's just top of mind, I'm sure there's other methods.
- danielbln 3y agoJust generate one for this purpose and then revoke it when you're done. You can have more than one key.