I'm trying to offer a service to users that allows them to write Python via pyodide or R code via webR in their browser against my own data. I've been thinking of ways to go about this and I'm curious if this is a stupid idea.

pyodide and webR are just web assembly versions of Python / R so a user can write code and ideally share it on the web or with other users. The code they will be writing will be accessing files hosted on AWS S3 which require an API key to access.

Due to all of this being done in the browser and ideally users sharing code their API Key will essentially become a public key. My thought process is I can use their IP as a private key for their access to the API. It will be annoying when a user changes networks / is away from their home network but I figure I can build a simple admin UI that allows them to quickly update their IP / secret key securely via a more traditional web app.

I think doing it this way will make code and the data much more accessible for users and be ideally less costly for me as I just need to manage a whitelist of IPs among other things. I feel like the logic of it makes sense, but is there a better-known way to go about doing this?

  • What about multiple people sharing the same IP? If the API key is public, then you lose all control over the keys.
    – schroeder
    Jul 3, 2023 at 12:49
  • In general, if you are tying authentication to IPs, your design is wrong. You should rethink your approach.
    – schroeder
    Jul 3, 2023 at 12:51
  • @schroeder if multiple people share the same IP then for my case that'd be okay, I would just be assuming they work for the same org or share the same network. Those users would be in some way associated with one another.
    – S3AN556
    Jul 3, 2023 at 19:36
  • @schroeder There is a lot of ways this can go wrong though, especially if I had a lot of users interacting with it. I do not think many users will use this feature though which is why I think it could be a viable way to deliver this. I see so much content shared around the web where users knowingly or unknowingly expose their API keys to access data. By sharing scripts to visuals / dashboards... whatever in the data science community. I think this could be a way to give some additional layer of protection to users that do this, but also to myself if they'd be accessing my data.
    – S3AN556
    Jul 3, 2023 at 19:44


You must log in to answer this question.

Browse other questions tagged .