Not any more than any other public endpoint service exposes.
This revocation endpoint can be protected by auth too. Use API key that you're revoking in auth.
I see now from another comment you thought about denial of service for service that leaked key. And I thought about mass leak resulting in DDOS onto API provider. Wrong guess from me.
In this case you'd probably prefer your key to be disabled rather than spending $$$ on tokens for everyone else
Think that through - the person who stole the key has the decision to use it or revoke it through this hypothetical system.
If they are acting maliciously, they will take the choice that most hurts you and/or benefits them.
If the key is useless to them and revoking it hurts you, then they would do that.
If the key wasn’t useless to them, then… they would just use it and not revoke it?
It for whitehat third parties who discover unprotected keys obviously people intentionally stealing keys will not revoke them generally.
1 reply →
Not any more than any other public endpoint service exposes. This revocation endpoint can be protected by auth too. Use API key that you're revoking in auth.
How does that make any sense?
I see now from another comment you thought about denial of service for service that leaked key. And I thought about mass leak resulting in DDOS onto API provider. Wrong guess from me.
Yes. Is this a bad thing?
Of course it is? A key for some weather API getting leaked isn’t the end of the world, but having it revoked and breaking your weather app is.