Map Tile API请求安全咨询：如何更安全防护应用私钥

Great question—this is a common pain point when securing HERE Maps API requests, especially since exposing app_id and app_code directly in URL parameters puts your credentials at immediate risk, and basic domain restrictions are easy to bypass with a forged Host header. Here’s a breakdown of the most robust alternatives to protect your app keys and block unauthorized calls:

1. Use OAuth 2.0 Token Authentication #

HERE Maps supports the OAuth 2.0 client credentials flow, which replaces static app_id/app_code pairs with short-lived access tokens. Here’s how to implement it:

• Server-side token generation: Your backend server uses your app_id and app_code to request an access token from HERE’s OAuth endpoint. Never run this on the client side—keep your core credentials locked to your server:

  curl -X POST "https://account.api.here.com/oauth2/token" \
       -d "grant_type=client_credentials&client_id=YOUR_APP_ID&client_secret=YOUR_APP_CODE"
  

• Client-side usage: Pass the token in the Authorization HTTP header instead of URL parameters when calling the Map Tile API:

  GET /maptile/2.1/map/newest/normal.day/10/345/232/256/png8 HTTP/1.1
  Host: base.maps.ls.hereapi.com
  Authorization: Bearer YOUR_ACCESS_TOKEN
  

Tokens expire after 24 hours by default, so you’ll need a backend flow to refresh them automatically. This way, your raw credentials never touch the client, and leaked tokens have limited, short-term utility.

2. Implement Signed Requests #

HERE lets you sign API requests with your app_code, ensuring only requests generated with your valid credentials are accepted. This prevents attackers from modifying or reusing intercepted requests:

• Server-side signing: Generate a unique signature for each request using your app_code, plus request-specific details like the URL path, timestamp, and a random nonce. HERE provides language-specific libraries and docs to simplify this process.
• Signed request format: Append the signature, timestamp, and nonce as URL parameters (e.g., &signature=abc123&timestamp=1699999999&nonce=xyz789). The HERE API will validate the signature against your app_code before processing the request.
  Critical note: The signing process must happen entirely on your backend—never expose your app_code to end-users.

3. Route Requests Through a Server-Side Proxy #

This is the most secure approach for client-side apps (web/mobile):

• How it works: Instead of letting clients call the HERE API directly, have them send requests to your own backend server. Your server forwards the request to HERE using your valid credentials (either app_id/app_code or an OAuth token) and returns the tile data to the client.
• Extra perks:
  • Your core credentials are completely hidden from end-users.
  • You can add custom security layers like user authentication, rate limiting, or IP whitelisting to block malicious traffic.
  • You can cache frequently requested tiles to cut API costs and improve load times.

4. Strengthen Domain Restrictions (As a Supplementary Measure) #

While basic Host header restrictions are easily bypassed, you can make them more effective when paired with other controls:

• If using a proxy server, validate the actual request origin using headers like X-Forwarded-For (only trust these if they come from a trusted CDN or load balancer, as they can be forged).
• For web apps, add a Content Security Policy (CSP) to restrict HERE API calls to your domain. Example directive:

  Content-Security-Policy: connect-src 'self' https://base.maps.ls.hereapi.com;
  

This won’t stop determined attackers, but it adds an extra layer of defense against casual credential scraping.

Final Recommendation #

For maximum security, combine server-side proxying with OAuth 2.0 tokens. This setup completely hides your core credentials from clients, gives you full control over API access, and minimizes the risk of unauthorized calls.

内容的提问来源于stack exchange，提问作者Pierre Laferriere