1.5 KiB
1.5 KiB
API access control for CartoDB
There are 3 main API:
- SQL API
- REST API (internal use mainly)
- Map tiles API
Currently, CartoDB has problems with a non-standard OAuth implementation and a semi-implemented API-KEY authentication method
We propose:
- standardising the Data API (SQL + REST) on plain OAuth.
- Reusing the API-KEY for the Map tiles API as a 'Map Key'
Standardising the Data API on plain OAuth
- Remove API-KEY access method from all API and authenticate methods (warden.rb)
- Update filter for access_token to store all keys in Redis: consumer, request & access
- Implement full OAuth checking (eg check headers and signature) in the SQL API
- Add automatic generation of OAuth access tokens on the users API page if that's all they want. (User just needs consumer and access tokens to properly sign an OAuth request).
- Update all libraries to take the real OAuth change into account
Converting the API-KEY to Map Key
- Rename ApiKey model and tests to MapKey
- update provisioning in client_application.rb.
- update views to show map key, not ApiKey
- store ApiKey and domain in redis and count tiles served by tiler
- in node mapper app check request headers Referer:http://blah/ for to ensure requst is made from a map hosted on a legit domain (or at least record it somewhere?)
- auto make a MAPKey on user creation
- update map tiles JS to use mapkey