Bizarre that nowhere does this article say you must invalidate the key. Lots of people could well have pulled a branch with the key, and rewriting history will make this very obvious.
Accidental API Key Exposure is a Major Problem
11–16 of 16 posts
Re: Accidental API Key Exposure is a Major Problem
#12Bizarre that nowhere does this article say you must invalidate the key. Lots of people could well have pulled a branch with the key, and rewriting history will make this very obvious.
"If you can, you might want to consider revoking the keys that have been made public, so that anybody who may have discovered them already will be prevented from using them."
Re: Accidental API Key Exposure is a Major Problem
#13Bizarre that nowhere does this article say you must invalidate the key. Lots of people could well have pulled a branch with the key, and rewriting history will make this very obvious.
"As stated above, the history features of version control systems mean that simply removing the tokens and then committing the result is not enough. If you can, you might want to consider revoking the keys that have been made public, so that anybody who may have discovered them already will be prevented from using them."
Re: Accidental API Key Exposure is a Major Problem
#14Bizarre that nowhere does this article say you must invalidate the key. Lots of people could well have pulled a branch with the key, and rewriting history will make this very obvious.
"If you can, you might want to consider revoking the keys that have been made public, so that anybody who may have discovered them already will be prevented from using them."
Thats a very weak statement. It is the first thing you should do.
Re: Accidental API Key Exposure is a Major Problem
#15If you develop a API that requires a key, is there any secure way of allowing third party developers to develop client applications that use your API? It seems like a malicious party could just view the source of the client app and see the key and hijack it.
[deleted]
Re: Accidental API Key Exposure is a Major Problem
#16I had this same issue when I started working on a side project. I quickly decided to store the Github API secret and client id in a property list, and then access it from there in the code. The keys are never exposed in the code and that's great. The property list file was ignored by my github repository and all was well with the world.
Until I started using a CI server, which would fail to compile because that file was no longer present when it was described in the project configuration. To fix this, I added a blank copy of the configuration file to the repository, committed that so that the project would compile on Travis, then ran `git update-index --assume-unchanged` to never update that file again, so that I could fill in the correct configuration data again.