💼 1.13 Ensure API Keys Are Restricted To Use by Only Specified Hosts and Apps - Level 2 (Manual)

• Contextual name: 💼 1.13 Ensure API Keys Are Restricted To Use by Only Specified Hosts and Apps - Level 2 (Manual)
• ID: /frameworks/cis-gcp-v2.0.0/01/13
• Located in: 💼 1 Identity and Access Management

Description

API Keys should only be used for services in cases where other authentication methods are unavailable. In this case, unrestricted keys are insecure because they can be viewed publicly, such as from within a browser, or they can be accessed on a device where the key resides. It is recommended to restrict API key usage to trusted hosts, HTTP referrers and apps. It is recommended to use the more secure standard authentication flow instead.

Similar

• Internal
  • ID: dec-c-a6c67529

Sub Sections

Section	Sub Sections	Internal Rules	Policies	Flags