Map API keys restricted by HTTP referrer in provider console
Why it matters
An unrestricted map API key — one with no HTTP referrer restrictions in the provider console — is a valid, usable credential that any third party can call from any domain. CWE-732 (Incorrect Permission Assignment for Critical Resource) applies because the key grants API access without the permission boundary it should have. OWASP A05:2021 (Security Misconfiguration) covers this directly. The practical consequence is quota theft: another site embeds your Mapbox token, your tile requests and geocoding quota are consumed, and you receive the billing overage. Referrer restrictions add a cheap, server-enforced permission boundary that the provider enforces — your code cannot compensate for a missing restriction.
Severity rationale
Low because referrer restriction is defense-in-depth — key theft requires an attacker who already has the key — but the consequence of unrestricted keys is measurable quota and billing exposure.
Remediation
Restrict each map API key in the provider console to your production domain. Document this in .env.example so future developers know the restriction expectation.
# .env.example
GOOGLE_MAPS_KEY=your-key-here # Restrict to yourdomain.com in Google Cloud Console > APIs & Services > Credentials
MAPBOX_TOKEN=your-token-here # Restrict to yourdomain.com in Mapbox Account > Tokens > URL restrictions
Google Cloud: APIs & Services > Credentials > click the key > Application restrictions > HTTP referrers > add https://yourdomain.com/*.
Mapbox: Account > Tokens > edit token > enable URL restrictions > add your domain.
Create separate keys for development and production; restrict each independently so a compromised dev key has limited blast radius.
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the Map & Location Integration Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- cwe · CWE-732 — Incorrect Permission Assignment for Critical Resource — unrestricted map API key
- owasp:2021 · A05 — Security Misconfiguration — API key with no HTTP referrer restrictions
Taxons
History
- 2026-04-18·v1.0.0·Initial import from directory-map-location·automated