2

Ok, many of you now the scenario: you login to developer.sayLinkedIn.com, create an app with credentials and define the domain in witch that key is allowed to "run". The question is, from a api provider perspective if possible: HOW do you make a key useless on domains other than the one you please.

I have api available for secure consumption in server side scripting scenarios, and would love to offer a way to consume it securely on the client side from a static public html resource, but since is a paid usage api and the key is sitting in the public domain you want your key to work only on sites-domain-ip that you define.

Improve this question

1 Answer 1

Reset to default
2

I would check the origin header when the request comes in and confirm that the domain making the request matches the one you have associated with the key.

This means you would need to track the association between domains and keys of paying customers on your end so you could check this.

Keep in mind that the origin header can be spoofed if the request is made using something like curl, so while this would be a good defense against web pages using your API without permission, someone could get around your restriction for their own personal use.

Improve this answer
1
  • Abe, you got the point! So given that you implement origin header check, how do you defend against attacks from something like curl as you just pointed out? Would you think that authorizing every api call with a One Time Hash Token strategy is a reasonable secure layer to add on top of that?
    – Guido
    Dec 1, 2013 at 10:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .