GeoDirectory adherence to Google best practices for API keys

This topic contains 1 reply, has 2 voices, and was last updated by  Alex Rollin 5 years, 2 months ago.

We have moved to a support ticketing system and our forums are now closed.

Open Support Ticket
  • Author
    Posts
  • #469750

    Educational Organization
    Expired Member
    Post count: 23

    I will be following the recommendations you made at https://wpgeodirectory.com/docs-v2/integrations/google/#secure

    However, I didn’t see any direct reference to GeoDirectory adherence to Google best practices for API keys at https://wpgeodirectory.com/docs-v2/integrations/google/#easy

    How does GD follow the following recommendations given by Google at https://cloud.google.com/docs/authentication/api-keys?hl=en&visit_id=636860961423027514-3960933062&rd=1

    Securing an API key

    When you use API keys in your applications, take care to keep them secure. Publicly exposing your credentials can result in your account being compromised, which could lead to unexpected charges on your account. To help keep your API keys secure, follow these best practices:

    Do not embed API keys directly in code. API keys that are embedded in code can be accidentally exposed to the public. For example, you may forget to remove the keys from code that you share. Instead of embedding your API keys in your applications, store them in environment variables or in files outside of your application’s source tree.

    Do not store API keys in files inside your application’s source tree. If you store API keys in files, keep the files outside your application’s source tree to help ensure your keys do not end up in your source code control system. This is particularly important if you use a public source code management system such as GitHub.

    Set up application and API key restrictions. By adding restrictions, you can reduce the impact of a compromised API key.

    Delete unneeded API keys to minimize exposure to attacks.

    Regenerate your API keys periodically. You can regenerate API keys from the Credentials page by clicking Regenerate key for each key. Then, update your applications to use the newly-generated keys. Your old keys will continue to work for 24 hours after you generate replacement keys.

    Review your code before publicly releasing it. Ensure that your code does not contain API keys or any other private information before you make your code publicly available.

    #469821

    Alex Rollin
    Moderator
    Post count: 27815

    GD uses Google APIs in lots of places, and the key is published, so we recommend securing it, as you noticed:
    https://wpgeodirectory.com/docs-v2/integrations/google/#secure

    If the key is secured to be used only on your site URL, then no one else can simply copy the key to use it somewhere else.

Viewing 2 posts - 1 through 2 (of 2 total)

We have moved to a support ticketing system and our forums are now closed.

Open Support Ticket