API keys with "HTTP referrers" restriction are not working

Created on 5 November 2019, about 5 years ago
Updated 30 October 2023, about 1 year ago

Google API Keys on websites can be restricted by IP addresses or by HTTP Referrer or not be restricted at all.

Not restricting the API key leaves it vulnerable for unauthorized use (which could be a problem for paid services like this one).
Having the HTTP Referrer restriction might not be perfectly secure, but we want to be able to use it.

Currently module doesn't sent an referrer when making a request to Google API, which means if the key is restricted by referrer the key isn't correct. The message returned is this:

Google Translate service returned following error: Requests from referer are blocked.
The "Google API key" is not correct.

Feature request
Status

Needs work

Version

1.0

Component

Code

Created by

🇨🇭Switzerland Zekvyrin Switzerland / Greece

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

Not all content is available!

It's likely this issue predates Contrib.social: some issue and comment data are missing.

  • 🇨🇭Switzerland colorfield Lausanne

    Here is a re-roll if someone needs it but agree with
    #6 the referrer method might not be ideal security wise
    #7 not using the ui can cause issues so we need to change this to get the base url

  • achap 🇦🇺

    Just want to clarify my comments from number 7. It should work if you pass the --uri parameter when running via drush. Cron I'm less certain on but I imagine you can set the correct value somewhere.

Production build 0.71.5 2024