2 ms·
I don't see this being a problem in situations where a customer / user can bring their own keys. The actions happens on the client-side and as long as the devic
by _pdp_ 2y ago
I don't see this being a problem in situations where a customer / user can bring their own keys. The actions happens on the client-side and as long as the device or the website are not compromised it is all good.
However, this is definitely increasing the attack surface where a developer may decide for whatever reason to use production keys client-side without proxying the requests as they would normally do. I can see this being done out of convenience and performance reasons not taking into account security considerations.
- vdfs 2y agoAlso, this was always possible using a simple proxy that directly send requests to their API
- riquito 2y ago> as long as the device or the website are not compromised it is all good But that is THE problem. You are making yourself a huge target. The more users you have the most likely someone will attempt to hack you to use all those keys. The "client side" point is moot because the code that uses those keys comes from the server, once that's compromised all hell is loose.
- ikekkdcjkfke 2y agoNotnpossible to generate a limitee key in 2024?