search

pkmnct / qualtrics-google-map-lat-long

Embed a customizable Google Map in your Qualtrics survey to collect location data
MIT License
21 stars 13 forks source link

Google API key visible to respondents #11

Closed jntrcs closed 4 years ago

jntrcs commented 4 years ago

From my research, this seems to have a quite severe vulnerability in that you have to copy and paste your API key directly into the client-side javascript. Since this is a billable API key, couldn't any survey respondent scoop it up and then use your key to do things that would result in you being charged?

I'm no web developer, but that seems to be the case.

pkmnct commented 4 years ago

Yes, the API key is exposed, though this is how Google recommends using their Maps API. There are steps that can be taken to minimize the risk associated with this. See Google's documentation on Adding restrictions to API keys.

If you're interested in more information, I recommend reading What steps should I take to protect my Google Maps API key on Stack Overflow.