Distance calculator - Google API 1

[Koen Piller]

Hi,
The code provided bij Mike Gagnon Link needs now an Google APIKey.
This Key is easy to obtain from Google, but how to implent in the code?
Regards,
Koen

 

[Olaf Doschke]

You're asking how to keep this key secret, right?

Read this discussion:

https://softwareengineering.stackex...27745/best-way-to-hide-api-key-in-source-code

The conclusion is you better not embed this directly into a VFP executable. Because in the end Fiddler added as a proxy can record HTTP traffic, even HTTPS.

The solution is to have your own proxy on an own domain in conjunction with using Googles own key management mechanisms to restrict key usage from one domain only, your proxy service domain.

Now the problem only seems to be shifted, as your own domain needs to act as a proxy between your EXE which means now your domain is becoming the target, anyone could use your key by using your proxy. You have some advantages, even though the communication of your EXE with your proxy can still be eavesdropped on. Your proxy may only support part of the functionality and using it only gives an attacker the ability to use the rate limit. It already is far less interesting. Besides, as long as you only use what you get free by using a free key, that key is not really valuable for neither you nor Google nor others, as everyone can get free keys.

And aside of that with your own proxy, the part of the communication between your EXE and your proxy is totally up to you, you can sign every request with one time keys or do whatever you want that makes eavesdropping on this communication useless. The part of the communication between your proxy and Google is protected by the Google API key restriction, your domain bound key is useless for others, and you should trust your hoster enough both to protect your server-side code and not use keys deposited there themselves.

Bye, Olaf.




Olaf Doschke Software Engineering

https://www.doschke.name

 

[Koen Piller]

Hi Olaf,
No I was not asking to keep this KEY secret, I was asking how to implant the KEY into the coding

lcFullURL = "[URL unfurl="true"]http://maps.googleapis.com/maps/api/directions/xml?"[/URL] + m.lcRouteParameters + ;
"&units=metric&sensor=false" &&+ m.tlShowRouteDetails

If I simply replace the directory api in this URL with my KEY - error
For your info I am implanting this into an application which I constructed for my own private use, no way to send it to others.
Regards,
Koen

 

[Olaf Doschke]

OK, in this case key secrecy is optional, but about using the key, that's documented, isn't it?

https://developers.google.com/maps/documentation/distance-matrix/start

It is appended as a parameter of the HTTPS request.

Bye, Olaf.


Olaf Doschke Software Engineering

https://www.doschke.name

 

[Koen Piller]

Olaf,
Thanks for the link.
Regards,
Koen