API Key Restriction for Google API Called from URL Fetch within App Engine

Question

I have an API Key for a Google API that I would like to use in all my requests to it. Some of these requests will originate from within a Google App Engine (Python 2.7) application. I had planned to use the UrlFetch library to complete the POST request, basically as follows:

headers = {'Content-Type': 'application/json'}
payload = {'longUrl': request.long_url}
result = urlfetch.fetch([API_REQUEST_URL],
                method=urlfetch.POST,
                payload=json.dumps(payload),
                headers=headers)

json_result = json.loads(result.content)

I had set a referrer restriction on my API Key to *.[my-app].appspot.com/* with the hope that this would protect my API Key from unauthorized use and negate the need to update an IP-based key restriction (as App Engine IPs change all the time).

This approach as failed me though, because it seems that urlfetch does NOT specify a value for referrer on its own. I assume I could add my own referrer, but then so could anyone else. The approach isn't very secure.

What is the best practice? How should I restrict the key given that I'm using urlfetch from within App Engine? If I do use an HTTP Referrer restriction, which address do I use?

Many thanks.

Answer 1

You got like this error message?

Requests from referer <empty> are blocked.

urlfetch seems not to attach Refer automatically, so you should set Refer in your request header.

headers = {'Content-Type': 'application/json','Referer': '*.[my-app].appspot.com/*'}

Answer 2

As you observed the referrer header can be faked, so setting a referrer restriction on your API Key is rather useless to start with.

But you can add a check based on the X-Appengine-Inbound-Appid header, which is sanitized by the GAE infrastructure and precisely identifies the app. From Issuing a request to another App Engine app:

When issuing a request to another App Engine app, your App Engine app must assert its identity by adding the header X-Appengine-Inbound-Appid to the request. If you instruct the URL Fetch service to not follow redirects, App Engine will add this header to requests automatically.

To instruct the URL Fetch service to not follow redirects, set the fetch follow_redirects parameter to False.

Note: If you are making requests to another App Engine application, use its appspot.com domain name rather than a custom domain for your app.