3

I am studying CartoDB, and am wondering:

To what extent is CartoDB SQL API secure?

From their description about authentication, you can submit entire SQL statements in the URL by appending the api_key to it as follows.

https://{username}.carto.com/api/v2/sql?q={SQL statement}&api_key={api_key}

When you use it in HTML/JavaScript, what prevents this key from being seen by others and used to change your tables (or perform SQL injection)?

I have seen API keys used elsewhere (e.g. Google Map) for counting visits and charging fees. But I don't quite understand the concept of using API keys in the URL for authentication. How does the security model work here? (Or what's the correct way to make security work?)

A related question is, if CartoDB is set up and used in a intranet (if possible), how is one supposed to configure security for the CartoDB/Postgres instance?

|improve this question
  • 1
    One would hope they support a POST request, as well, but the encryption protocol would protect either (and if the key was well designed, it couldn't be reused from a different client, permitting it to be used from an HTTP protocol as well). This is probably more of a question for the folks at Information Security – Vince Apr 1 '17 at 19:38
  • 1
    I think this is a perfectly good question for GIS -- CartoDB is eminently about GIS, and I don't see why security an apikey in the context of distributed processing is off topic, as modern GIS encompasses a lot of technologies that come from other parts of computer science. – John Powell Apr 3 '17 at 9:03
  • https uses an underlying TLS protocol, which typically uses long-term public and private keys to generate a short-term session key. It is secure for your session. – Mapperz♦ Apr 3 '17 at 14:30
1

API key is not meant to be used on frontend applications, only on middleware software under a secure environment. Using your API key on a frontend application, even supporting POST is of course highly discouraged since it would expose your database to anyone inspecting the traffic.

Check the documentation and specially this article regarding SQL injection.

Please post your other question on a separated article.

|improve this answer
0

This isn't necessarily a best practice, but 'draw your own neighborhood' project by Nick Martinelli calls for the API key (which is placed outside of your web root) in PHP.

To my knowledge, none of the people (including myself) who've implemented their own copy of this (maybe 6-10 total) have had their API keys misused or their data deleted. The worst that we've had are submitted geometries resembling phallic symbols.

|improve this answer
  • oh my goodness... are you aware that anyone would be able to drop tables, change data, etc? It looks like the proxy he coded is not checking anything on the query so.... – Jorge Sanz Apr 3 '17 at 17:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.