Custom Safe Browsing API key #55
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Allow the user to configure a custom API key with fallback to the hard coded default. No sanity check yet, if the key is invalid the request fails.
Response code 200 is expected for a successful request, independent of the actual result. Separate response handling into 200, 4xx and 5xx and handle these cases differently.
If a Safe Browsing request fails because of an invalid/expired API key, the user is now notified about this, including the original API response and an advice whether to check or provide a custom key.
|
I've extended the error handling in case of 4xx errors, s.t. the error message from the API (if available) is sent along with a notification. The mail points out that this is not necessarily a security warning and suggests to check the key, if yet provided, or provide a custom key if our defauls is exceeded. |
stklcode
force-pushed
the
feature/custom-safe-browsing-key
branch
from
5d1f8be to
6f9a4b5
Compare
|
Added some unit tests to verify key usage and mail behavior. Tests require runkit(7) to intercept HTTP and mail. I've already adapted CI configuration, but this is probably out of scope for this PR. |
stklcode
force-pushed
the
feature/custom-safe-browsing-key
branch
from
6e49b0a to
5e5c8c1
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
To overcome the rate limitations of the hard-coded API key I've added an option to provide a custom key.
If the key is given, i.e. is not empty, it is used instead of the default. However the fixed key is still available as fallback.
As there's a risk of misconfiguration now, because the key may be invalid or expired I've also split the response handling. There's an open TODO in handling the error cases.
Old:
New:
Although you might expect a 403 from an invalid code[1], I've seen a 400 with an arbitrary invalid key (i.e. "foobar") and message "Invalid API key ..." in the JSON body.
[1] https://developers.google.com/safe-browsing/v4/status-codes