What problems do I have to expect if I publish a userscript that embeds the score from TMDB on IMDb. This question I just also in view of the API key, which is then also public.
I want to publish a javascript for Tampermonkey/Greasemonkey, which embeds the score from TMDB in IMDb. So that the score can be displayed, my API Key is needed.
My question is, could publishing my API Key through this javascript be a problem? Like violating some rule.
Not sure it's against a rule per se, but it makes your key easy to steal. If a bad actor were to get a hold of your API key and start using maliciously and we have to block it, it will take your project offline. I suppose that is the main concern you should be thinking about.
Yes, that is what worries me. So my question is how the API key could be used maliciously? And if I were to be blocked, could I request a new one, which I would then accordingly no longer publish?
A solution might also be an API key that could be assigned with restrictions, e.g. read-only rights and quantity of requests.
ofitichor 的回复
于 2023 年 10 月 01 日 3:11下午
An answer would help me 😅
robbie3999 的回复
于 2023 年 10 月 02 日 5:35下午
If you want an answer you need to ask a more specific question. No one knows what your app is and what kind of problems you might have with it.
ofitichor 的回复
于 2023 年 10 月 03 日 3:02上午
Actually, I thought I was already very special.
I want to publish a javascript for Tampermonkey/Greasemonkey, which embeds the score from TMDB in IMDb. So that the score can be displayed, my API Key is needed.
My question is, could publishing my API Key through this javascript be a problem? Like violating some rule.
Travis Bell 的回复
于 2023 年 10 月 03 日 10:29上午
Not sure it's against a rule per se, but it makes your key easy to steal. If a bad actor were to get a hold of your API key and start using maliciously and we have to block it, it will take your project offline. I suppose that is the main concern you should be thinking about.
ofitichor 的回复
于 2023 年 10 月 03 日 10:35上午
Yes, that is what worries me. So my question is how the API key could be used maliciously? And if I were to be blocked, could I request a new one, which I would then accordingly no longer publish?
A solution might also be an API key that could be assigned with restrictions, e.g. read-only rights and quantity of requests.
Travis Bell 的回复
于 2023 年 10 月 03 日 10:46上午
We have to block keys semi regularly because they are used on illegal streaming sites, piracy and the like.
Yes, you can re-generate a new key from within your account's API settings page at any time.