undefined | Better HN

0 pointsmarblar9y ago0 comments

There's no need for a middleware service. Just store it outside of the repo.

0 comments

10 comments · 1 top-level

jaebradley9y ago· 9 in thread

It's an NPM package that people download - how would you store it outside the repo such that people that download the package can reference the token? Can't really use an environment variable at that point, right? There probably has to be some HTTP request to some service that ends up forwarding the request to Uber with the token. Maybe I'm over-thinking this...

elgenie9y ago

    $ uber time '123 anywhere st'
    No API key found. Please create one using the
    instructions at <site> and call 'uber set-key <key>'
    $ uber set-key <key> # writes <key> to a file in home dir or a .gitignore location in the repo
    Well done!
    $ uber time '123 anywhere st' # reads <key> from file, works as you have it
    ...

lexpar9y ago

I think the idea is that you implement some interface for interested users to supply their own API keys.

jaebradley9y ago

Gotcha - ok, that certainly makes sense. Though makes for a slightly less friendly (but certainly more secure) service.

1 more reply

Chloro9y ago

Yep!

kfrzcode9y ago

So if I clone this repo I can now access your API account? Might want to pull this repository from Github......

jaebradley9y ago

You would have access to my server token, certainly. But I checked the documentation and in order to request rides, I think you would need other pieces of information that I did not expose. Additionally, there are various scopes that Uber grants regarding the API exposure that any application has.

I think / hope that the worst damage that can be done is hitting Uber's rate limit.

Definitely not defending my decision to include the server token, but I don't think it's the end of the world (just terrible practice).

1 more reply

divbit9y ago

I guess it might be better to disable the api key...

dzhiurgis9y ago

How does Google Maps get this information? They probably have their middleware, right?

throwanem9y ago

> Can't really use an environment variable at that point, right?

Why not?

j / k navigate · click thread line to collapse

0 comments

10 comments · 1 top-level

jaebradley9y ago· 9 in thread

elgenie9y ago

    $ uber time '123 anywhere st'
    No API key found. Please create one using the
    instructions at <site> and call 'uber set-key <key>'
    $ uber set-key <key> # writes <key> to a file in home dir or a .gitignore location in the repo
    Well done!
    $ uber time '123 anywhere st' # reads <key> from file, works as you have it
    ...

lexpar9y ago

I think the idea is that you implement some interface for interested users to supply their own API keys.

jaebradley9y ago

Gotcha - ok, that certainly makes sense. Though makes for a slightly less friendly (but certainly more secure) service.

1 more reply

Chloro9y ago

Yep!

kfrzcode9y ago

So if I clone this repo I can now access your API account? Might want to pull this repository from Github......

jaebradley9y ago

I think / hope that the worst damage that can be done is hitting Uber's rate limit.

Definitely not defending my decision to include the server token, but I don't think it's the end of the world (just terrible practice).

1 more reply

divbit9y ago

I guess it might be better to disable the api key...

dzhiurgis9y ago

How does Google Maps get this information? They probably have their middleware, right?

throwanem9y ago

> Can't really use an environment variable at that point, right?

Why not?

j / k navigate · click thread line to collapse