Im investigating the translate API and the example script contains a warning advising me to use a proxy to hide my api key.
// WARNING: be aware that YOUR-API-KEY inside html is viewable by all your users.
// Restrict your key to designated domains or use a proxy to hide your key
// to avoid misuse by other parties.
I am just wondering how do I run the script via a proxy?
UPDATE: Thanks for this.. I have since removed the project as it was made redundant. But great advice
I believe in this instance the reference to proxy means a server side encapsulation (or something similar) to hide the API key. You'd therefore make a call to your server, which would proxy the call to Google instead of making the call in client-side Javascript and exposing your API key.
Related
I have a website hosted in AWS with a NodeJS backend.
I have Google Ads conversion events being sent from the frontend using gtag.js, but I noticed missing events and a lot of duplication (even if I use transaction IDs with my events)
I has similar issues with Facebook Pixel and was able to resolve the problem by sending simple vanilla http calls from the backend.
Is it possible to do the same with Google Ads? I have not been able to find any documentation for server side APIs for Javascript.
This documentation here seems promising, but no Javascript SDK exists. That's is why I would like to know what vanilla http calls to make.
I have seen documentation about GTM server side, but it seems I need to host a GTM container (server?) which I would prefer not to have to. Unless I misunderstood what hosting a GTM container means in the context of a AWS cloud solution.
In addition to the native, gRPC-based Ads API there's also a REST alternative which can be used if there's no native client library, such as for NodeJS.
The endpoint relevant for your use case is customers.uploadClickConversions, which allows you to register a conversion given a specific click ID.
Keep in mind that you'll need to apply for API access in order to be able to use the Ads API (aside from accessing test accounts).
I'm working on some app which should use Google Maps JS API (browser version).
And there exists one problem I've got very concerned about.
API keys have restriction to be used only from your domain, however, any request from your domain (for example, from code inspector) is considered a valid request. So, anyone can make a simple script and kick my quota out easily.
So, here is my question:
Is there any option or command to run to block such activity ? Like the script will load just one instance and then will not accept creation of a new one or something like that.
P.S. I know about free quota for mobile versions of API, but I need the browser to work too. Obviously, I don't load this in any public area, but anyone can pretend to be a client and even order some service for couple bucks, but then run the script to make an impact for thousands ((
I use firebase with custom url. However the websocket connection uses still wss://.firebaseio.com/.
Is it possible to move this configuration to the custom domain?
also 'verifyToken' and getAccountInfo is always through https://www.googleapis.com/.
thank you
No - unfortunately that's not possible. What you're asking would involve rewriting some of the internal logic hard-coded on Firebase's servers... and Firebase doesn't expose that kind of functionality.
While this may be possible, it's not a recommended solution. You won't be able to achieve this purely by configuration alone, and it is just speculation about whether or not it will work.
When Firebase initializes, there is a configuration parameter for the destination of the websocket it establishes. Since you haven't said which platform you're using, I'll leave it up to you to read the documentation to see which parameter you have to change in your call to initialize Firebase.
After you change this parameter, you will need to have some proxy service at the destination to route all that traffic to the actual websocket destination at Google. This is a broad topic, and you will have to figure out how you want to implement this proxy.
Scenario: Auth0 Single Page application client. .NET Web API and Angular SPA both configured to use this client. Works great.
I'd like to add Azure API Management as a layer in front of the API. Have set up the API in the Management Portal, updated SPA to call API, tested calls from SPA, works great.
Now, I'd like to configure API Management Portal with the right security settings such that people can invoke API calls from the Developer Portal. I've used this [https://auth0.com/docs/integrations/azure-api-management/configure-azure] as a guide.
Where I'm at:
From the Developer portal, I can choose Authorization Code as an Auth type, go through a successful sign-in process with Auth0 and get back a Bearer token. However, calls made to the API always return 401. I think this is because I'm confused about how to set it up right. As I understand it:
either I follow the instructions and setup a new API client in Auth0, but if that's the case then surely it's not going to work, because tokens generated from one client aren't going to work against my SPA client? (or is there something I need to change to make it work)
or, how should I configure Azure API Management to work with a SPA application. (this would be my preferred method, having two clients in Auth0 seems 'messy'). But, don't I need an 'audience' value in my authorization endpoint URL? How do I get that?
If anyone has done this, would very much appreciate some guidance here.
Well, I didn't think I'd be back to answer my own question quite so soon. The reason is mostly rooted in my general ignorance of this stuff, combined with trying to take examples and fuse them together for my needs. Posting this to help out anyone else who finds themselves here.
Rather than take the Single Application Client in Auth0 and make it work with Azure API Management, I decided to go the other way, and make the non-interactive Client work with my SPA. This eventually 'felt' more right: the API is what I'm securing, and I should get the API Management portal working, then change my SPA to work with it.
Once I remembered/realised that I needed to update my audience in the API to match the audience set in the Client in Auth0, then the Management Portal started working. Getting the SPA to work with the API then became a challenge: I was trying to find out how to change the auth0 angular code to pass an audience to match the one the API was sending, but it kept sending the ClientID instead. (by the way, finding all that out was made easier by using https://jwt.io/ to decrypt the Bearer tokens and work out what was happening - look at the 'aud' value for the audience.
In the end, I changed my API, in the new JwtBearerAuthenticationOptions object, the TokenValidationParameters object (of type TokenValidationParameters) has a property ValidAudiences (yes, there is also a ValidAudience property, confusing) which can take multiple audiences. So, I added my ClientID to that.
The only other thing I then changed (which might be specific to me, not sure) is that I had to change the JsonWebToken Signature Algorithm value in Auth0 for my non-interactive client (advanced settings, oAuth tab) from HS256 to RS256.
With all that done, now requests from both the API Management Portal, and my SPA work.
Curious to know if this is the "right" way of doing it, or if I've done anything considered dangerous here.
Since you're able to make the validation of the jwts with the .Net API work, Only few changes are actually necessary to get this working with Azure API Management.
In API management,
Create a validate-jwt inbound policy on an Operation (or all operations)
set the audiences and issuers the same as what you've used with your .NET web api. (you can check the values in Auth0 portal if you don't know this yet)
The important field that is missing at this point is the Open ID URLs since auth0 uses RS256 by default. The url can be found in you Auth0 portal at: Applications -> your single page application -> settings -> Scroll down, Show Advanced Settings -> End points. Then copy the OpenID Configuration
Here's the reference for API management's requirement for JWT tokens
optional reading
I have an app that uses a google spreadsheet to populate a menu and some related pages. Works great in debug but gives the "security error" when released.
It seems like some google services (eg picasa) permit flex apps to access them. Is google docs not open this way?
What is the API URL you are checking? Does that URL have a CrossDomain.xml file? If not; then you can't access it directly from a Flex (or Flash Player) app. You'll have to use a Proxy of sorts.
Most people implement Proxy's on the server side. Basically, your Flex app will call the proxy and send the appropriate data. The proxy will then call the API (in this case Google Docs), get the results of that call, and then return the results to the Flex app.
Doing a quick search, I found this page. Are you trying to access the spreadsheets.google.com URL? If so, check out it's crossdomain.xml file. It appears to prevent all access.