search

googlemaps / js-api-loader

Load the Google Maps JavaScript API script dynamically.
Apache License 2.0
342 stars 64 forks source link

Support digital signature #578

Closed jasonhuang-sky closed 2 years ago

jasonhuang-sky commented 2 years ago

Hi all,

I would like to add new loader option signature to support digital signature to google maps static api request Although it is recommended, but it is not required, so my propose will not include the part of how to generate the signature, we just need to generate the signature in the host application and pass the signature into this library as an option param

So the required changes are basically like this https://github.com/googlemaps/js-api-loader/pull/582

We strongly recommend that you use both an API key and digital signature, regardless of your usage.

Mentioned in google maps api security best practices

  1. Digital signatures use an encryption algorithm to combine the URL and your shared secret. The unique signature generated allows Google's servers to verify that any site using your API key to generate a request is authorized to do so.
  2. Obfuscate or encrypt the API key or signing secret. This complicates scraping of API keys and other private data directly from the application.
  3. For the Maps Static API and Street View Static API, in addition to an API key, you need to provide a digital signature to exceed the daily quota of 25,000 map loads.

More details: https://developers.google.com/maps/documentation/maps-static/digital-signature

jpoehnelt commented 2 years ago

@jasonhuang-sky Please take a moment to fill out this short survey. Thank you!

This is an automated message, feel free to ignore.

jpoehnelt commented 2 years ago

@jasonhuang-sky Thank you for opening this issue. 🙏 Please check out these other resources that might be applicable:

This is an automated message, feel free to ignore.

jpoehnelt commented 2 years ago

I do not quite follow, as far as I am aware Maps Static API and Street View Static API have nothing to do with loading the Maps JavaScript API.

Both of those APIs require making a standalone HTTP get request with a signature specific to the query parameters of each request, see https://www.npmjs.com/package/@googlemaps/url-signature for a library to sign in nodejs. signature is not listed as an option at https://developers.google.com/maps/documentation/javascript/url-params.