Get API key out of embed codebase #16
Conversation
## Description We're almost certainly going to open-source this codebase at some point, so let's get the API key out of it, since it's technically a secret. ## Test Plan Run locally and make sure the calculator works. Run locally with an incorrect key in `.env.local` and make sure it results in "Authorization failed". Vercel build to be tested as part of this PR process. ## Next Steps After deploying this change with a new key set in Vercel, make sure the old key isn't being used elsewhere (i.e. the first-party calculator), then revoke it.
|
The latest updates on your projects. Learn more about Vercel for Git ↗︎
|
|
I set the environment variable in the Vercel project (a new key, not the one I deleted from the code), and now that works. (I inspected source on the Vercel preview to make sure it's got the new key.) However, Cypress has to do its own build, and now that's failing. Will look into that, but for now: do you think this is a reasonable path? |
|
Cypress build is fixed (I added a line to the GH action config, and added the key to this repo's secrets) |
| @@ -2850,7 +2871,7 @@ posthtml-render@^3.0.0: | |||
| dependencies: | |||
| is-json "^2.0.1" | |||
|
|
|||
| posthtml@^0.16.4, posthtml@^0.16.5: | |||
| posthtml@^0.16.4, posthtml@^0.16.5, posthtml@^0.16.6: | |||
There was a problem hiding this comment.
The blessings and the curses of npm.
I don't think it's worth optimizing these for server side - but I'm assuming they don't all get bundled client side?
There was a problem hiding this comment.
This is in devDependencies, so irrelevant for client side.
Also, what this is saying is that all three version specs are satisfied by the same actual version of posthtml, so this isn't actually adding new code anyway.
There was a problem hiding this comment.
Ah good point, thanks. OK so in this case it's working. I was dimly recalling some pathological cases in the past where I had many revisions of the same library live at the same time. Thanks for correction!
Description
We're almost certainly going to open-source this codebase at some
point, so let's get the API key out of it, since it's technically a
secret.
In the end this is a little pointless as a matter of security, since
anyone could just inspect the embed site and see the key sitting there.
But this will at least prevent people from just cloning this repo
and using our key.
Test Plan
Run locally and make sure the calculator works.
Run locally with an incorrect key in
.env.localand make sure itresults in "Authorization failed".
Vercel build to be tested as part of this PR process.
Next Steps
After deploying this change with a new key set in Vercel, make sure
the old key isn't being used elsewhere (i.e. the first-party
calculator), then revoke it.