保护 API Key 和其他应用密钥
尝试英译中机翻我们总结的 API Key 相关经验文档… 尽量说人话 😊 情景 假设我们要发布一个基于 ArcGIS Maps SDK 的 app，并使用 API Key 来授权各种地图服务。API Key 的费用取决于接口调用的使用量。正常用户越多，产生的用量就越大，成本也就越高。没毛病——我们当然希望有更多用户。然而，假设某个黑客（bad actor）决定窃取我们的密钥，如果他能够利用某个漏洞获取这个 API Key，那么他的使用量最终也会算在我们的账单上。 不应该直接把密钥硬编码（hard-code）进 app 里，主要有两个原因： API Key 可能会被黑客从二进制文件中被提取出来 当需要更换 API Key 时，不用非得重新发一个新版本 API Key 会过期，但一般有效期比较长。假如我们创建密钥的时候设置了一年到期，那么黑客就可以白嫖将近一年。 API Key…
API keys and other application keys are crucial for securing applications that use various map services. These keys have costs based on usage, and the more users an app has, the higher the costs. While it is desirable to attract more users, securing API keys is essential to prevent hackers from stealing them and using them for their own benefit.
Hard-coding API keys in an app is not recommended due to two main reasons: hackers may extract keys from binary files, and API keys may need to be updated periodically, requiring a new app version. Setting a one-year expiration period for keys can allow hackers to use them for nearly a year without incurring costs. When API keys expire, apps cannot function, forcing developers to release new versions and update all users.
One approach to address these issues is to avoid hard-coding API keys in an app. Instead, developers can retrieve keys dynamically from a server using OAuth 2.0 Application Credentials. These credentials consist of a Client ID and Client Secret, and they allow developers to generate short-term, usage-based tokens dynamically. By using servers to host these credentials, developers can prevent token interception and MitM attacks, as the tokens are not transmitted through the network.
This method eliminates the risk of API keys being stolen and used for unauthorized access, making it a more secure solution for securing APIs.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — it may contain errors, so check the original before relying on it.
