Menu
I am asking this question after extensively reading Google's recommended approach, but I do have a problem with all these approaches, let me explain the situation.
I use combination of geolocation and geocoding API to know the approximate state location and then display relevant content. The geolocation API needs to be called obviously from the browser to get appropriate geolocation of the user. Google provides HTTP Referrer based restriction for this API. I know someone can easily spoof the referrer and make calls with the same API key. I do not see a huge advantage even though Google recommends this.
On the other hand Google does not allow HTTP Referrer for geocoding API, but it does allow that for the MAPS JavaScript API. But again if you are not using Google maps then using that API is violation of Google's terms. Now google recommends to move the code that uses geocoding web services API to be on the back-end so that your key will be protected. But since ultimately I need to deliver the result to a front-end web application that is publicly accessible and I can only make a browser based Ajax call to first get the geolocation to feed to geocoding, I ultimately need to make an Ajax call to get my geocoding information. Then someone can easily just latch onto my end-point to piggy back on and call the geocoding API as much as they want. So for situations like this I want to know what is the ideal and secured way to deal with. May be there are other APIs that might be an ideal situation for this.
620
We strongly recommend that you restrict your API keys when you generate them in the Google Cloud console.
The Geocoding API uses a pay-as-you-go pricing model. Geocoding API requests generate calls to one of two SKUs depending on the type of request: basic or advanced.
Address Geocoding in the Google Maps APIs. Forward Geocoding is the process of converting addresses (like a street address) into geographic coordinates (latitude and longitude), which you can use to place markers on a map or position the map.
You can see their tools in action and even get your free API key for 15,000 transactions per month. A very affordable and scalable solution for geocoding and maps, LocationIQ is as intelligent as its name. It acquires data from a bunch of different sources like OpenStreetMap and Open Addresses. And the great thing is, it works worldwide.
Security practices applicable to the individual Google Maps Platform product, such as Maps JavaScript API, are listed in the More information section. When you first create your API keys, restrict them with an application restriction, and one or more API restrictions.
It is full of different web services, such as: You can see their tools in action and even get your free API key for 15,000 transactions per month. A very affordable and scalable solution for geocoding and maps, LocationIQ is as intelligent as its name. It acquires data from a bunch of different sources like OpenStreetMap and Open Addresses.
In my case, I am not doing any maps so it's all purely server-side to get latitudes, longitudes and driving distance between two points. This today from Google support which might help and if you're using maps, then the links may provide further insight.
Regarding API restrictions, please note that HTTP referrers will not work on Geocoding API since HTTP referrers can only be used for client side services. In other words, Geocoding is a web service API and should only be used on server-side implementation. IP address restrictions should be used for web service APIs. However, if you are using the Geocoding API in a website, IP address restriction would not work. Please check the suitable restrictions for each API in the following link:
https://developers.google.com/maps/api-key-best-practices#api_key_table
To make this work, you should create a separate key and use the new one in your Geocoding API request URL. You may add a restriction to this key by using an "API restriction", and restrict it to Geocoding API only. If you don't want to create another key, you may keep using your current one but make sure to change your implementation and use the client side Geocoding service from the Maps JavaScript API. In that case, please refer to this documentation:
https://developers.google.com/maps/documentation/javascript/geocoding
Another suggestion would be to get a static IP address from your ISP, especially if you are planning to use it on a public website. For development purposes, a sound solution would be to get three separate keys: one for the staging and tests, another for server-side requests and a third one for client-side requests. That way, you are making sure your API key is protected.
152
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With
