Hi, if running bugsnag on the client, the docs tell me to put the api key in client-side code:
<script>window.bugsnagClient = bugsnag('API_KEY')</script>
Since the api key is public, I was wondering, what's the worst that could happen? I guess someone could use my key to spam my bugsnag dashboard with bogus events. I'm okay with that, but I wanted to make sure that this key isn't use for any authentication purposes or for retrieving data.
However, in this issue: https://github.com/bugsnag/bugsnag-react-native/issues/112
The OP is saying this public api key can be used to manipulate sourcemaps as part of an elaborate attack. That issue is still open, so I'm concerned about using bugsnag in client-side code.
taylorgoolsby
All 2 comments
How would you even intend for this to be implemented without the key being accessible to the user?
strideynet
on 24 Jul 2019
Hi @taylorgoolsby
Just to reassure you that the API key can only be used to send error reports / source maps to your Bugsnag account. The data then comes into your Bugsnag dashboard, which no unauthorized users can read. In the event that someone got a hold of your API key, they would not be able to compromise your data. They would in theory be able to send fake reports / source maps to your dashboard but we've not generally seen issues with such misuse of an API key. The impact to you would be low and it would be of no real benefit to an attacker.
We are considering whether we could support different authentication methods for uploading source maps and notifying releases in the future.
With error reports for Javascript projects, you're also able to activate domain whitelisting under your project settings to prevent error reports being stored by Bugsnag if they're a result of someone downloading your JS and running it locally / on a different site.
mattdyoung
on 24 Jul 2019
Related issues
killia15
路
6Comments
v3solutions
路
6Comments
mattimatti
路
4Comments
livthomas
路
4Comments
mdonjones
路
5Comments
Most helpful comment
Hi @taylorgoolsby
Just to reassure you that the API key can only be used to send error reports / source maps to your Bugsnag account. The data then comes into your Bugsnag dashboard, which no unauthorized users can read. In the event that someone got a hold of your API key, they would not be able to compromise your data. They would in theory be able to send fake reports / source maps to your dashboard but we've not generally seen issues with such misuse of an API key. The impact to you would be low and it would be of no real benefit to an attacker.
We are considering whether we could support different authentication methods for uploading source maps and notifying releases in the future.
With error reports for Javascript projects, you're also able to activate domain whitelisting under your project settings to prevent error reports being stored by Bugsnag if they're a result of someone downloading your JS and running it locally / on a different site.