[Bug] - Lock down mapbox API key somehow

PaulTreanor / MapGuesser

A fun geography game!

https://mapguesser.vercel.app

0 stars 0 forks source link

[Bug] - Lock down mapbox API key somehow #4

Closed PaulTreanor closed 1 week ago

PaulTreanor commented 1 week ago

Yikes at line 6

I'm guessing the best course of action here is to just limit API usage to just mapguesser.com from the MapBox console and then rotate the keys but I'm not totally sure.

PaulTreanor commented 1 week ago

Useful Resources

Access token security practices

To do

[x] Create new narrowly scoped Map read-only token
[x] Add URL restrictions to new token
[x] Add new token to source locally and test
[x] Add new token to Vercel and deploy a new build
[x] Rotate mapbox default public key

How token is loaded

I'm setting he token as an environment variable called GATSBY_MAPBOX_ACCESS_TOKEN in Vercel.