We are building a website and we are using plenty of third-party tools that basically give you an HTML script tag and ask you to place it into your index.html. A few examples of such tools are:

  • Google Analytics
  • Google Maps
  • Zendesk Web Widget

Usually, such tools give you some sort of key that identifies with your account. But that key is publicly visible to every visitor of the website as it is hardcoded into the HTML.

Therefore I was wondering, whether there are any protections against malicious users getting my key and using it for bad purposes, e.g.

  • spamming my Zendesk inbox.
  • spamming my Google Analytics with fake data, that is indistinguishable from real user data.
  • using up the whole of my Google Maps query quota by reusing the same key in their website.

I haven't tested all of the scenarios, but e.g. Zendesk works on our dev/test environments out of the box, suggesting that this could be an issue.

  • stackoverflow or webmaster SE ?
    – mootmoot
    Mar 27, 2019 at 9:57
  • This is security related tho :(
    – eddyP23
    Mar 27, 2019 at 12:37
  • IMHO, third party polluting "web analytic" (AKA web tracking) data is hardly seen as security question. It is simply an issue related to analytical data clean up and filtering.
    – mootmoot
    Mar 27, 2019 at 14:09
  • What about Google Maps, where you pay per query?
    – eddyP23
    Mar 27, 2019 at 14:31
  • As I already mentioned, this is a web a programming issue. I don't see why you want to expose the API key. The key should be known by your backend i.e. servlet/web container/CMS.
    – mootmoot
    Apr 1, 2019 at 7:26


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.