How to protect Google API Key in an open-source (Github + Heroku) application

问题

I'm creating an application I wish to open-source in the coming weeks. The source code is on Github and Heroku autodeploys the code when there is a new commit if it passes the Travis CI tests.

In this application, I've several API keys that I managed to keep out of the open source repository by using env variables in my heroku dynos.

For the Google server-to-server API, however, I must have a .p12 file. In php, the following will authenticate my client:

$client = new Google_Client();
$client->setApplicationName("Client_Calendar");
$service = new Google_Service_Calendar($client);

$key = file_get_contents('myKey.p12');
var_dump($key);

$cred = new Google_Auth_AssertionCredentials(
  'xxx@gserviceaccount.com',
  array('https://www.googleapis.com/auth/calendar'),
  $key
);

$client->setAssertionCredentials($cred);
if ($client->getAuth()->isAccessTokenExpired()) {
  $client->getAuth()->refreshTokenWithAssertion($cred);
}

...

$event = $service->events->insert($calendarId, $event, $sendNotifications);

At first, I thought I could extract the content of the $key variable and insert it in another heroku environment variable but the content is encrypted.

So, here's the question: How do you protect your .p12 key from being stolen in an open source repository?

PS: I simply create Google Calendar events and send notifications to the attendees; if you you know a way to do that without using .p12 file, I am all ears.

回答1:

Don't commit it. Seriously, it's that easy. You were on the right track with heroku config variables. In fact even from posting it here you're probably going to want to request a new key.

There's a suggestion to store whole config files in other places that may need credentials that you can store. S3 is a great place for that kind of thing. S3 has an amazing PHP component, too, for accessing S3 buckets.

来源：https://stackoverflow.com/questions/35137838/how-to-protect-google-api-key-in-an-open-source-github-heroku-application