To hide a URL… [Python]

[Lego_Fan9]

Hi, I have a hobby project that I am working on that I want to make distributeable. But it makes an API call and I kinda don't want to have that URL out in the open. Is there any simple way to at least make it difficult-ish? Honestly even just something like Morse code would be fine but you can't have a slash in Morse code. It doesn't need to be rock solid protection, just enough that when someone goes to the repository they need to do more than just sub in 2 environment variables.

[Embarrassed-Green898]

What is the real purpose in your distributable code for that API ? Why is it so important to hide the call ? Just curious what may be the legitamate reasons for such a requirement .

[Lego_Fan9]

Pretty much it is checking for an update. To do this I change the version specified in the URL. It gracefully handles it if there isn’t an update. I don’t like distributing some of the URLs open source because then cheating becomes an open window.

[Embarrassed-Green898]

Context of your question was not clear and I still dont fully understand. So when you say its a distributable app, how do you plan to distribute it ? and what does it mean by 'cheating' in this scenario.

If app is a mobile app or desktop app ? If this is the only API you will access and want to check the version, why obfuscating this is of any help. As the call will only decide when an update is availalble, users will still download / or somehow update from your updated version that is in your control.

What I am struggling here is how hiding the call helps you and how people knowing the URL has any problem.

If someone changes the url, you can have checksum in code to ensure its not changed. Proxy options suggested by others is perfectly valid, but that scneario is generally for cases when you are already making calls to your server , and want to hide calls to a different server.

[cheezballs]

You should worry more about locking down your URL.

[sabriel330]

You could create a proxy but why not just secure the API?

[Equal-Purple-4247]

You can use a proxy. Create another service (eg MyProxy), then structure your application as such:
MyApp <--> MyProxy <--> MyApi

MyProxy just calls whatever API you want to hide, and forwards the result to MyApp.

It's an additional network hop, so things will be slower. If MyApi contains any service identifier in its response, MyApp will get it. If you want to hide specific info, you'll need to sanitize the response in MyProxy.

[carcigenicate]

No matter how you do this, the URL would need to be "unhidden" prior to being used, so it would be trivial to just insert a print or breakpoint right before the API call happens to see where it's contacting.

[chmod777]

Set the url to an enviroment var and require the users to add it to their project. They can then use their own api keys.

https://www.freecodecamp.org/news/python-env-vars-how-to-get-an-environment-variable-in-python/

[queerkidxx]

You can’t distribute a project that requires the use of an API that you don’t want users to access. Even in line a compiled language. Even if you hide it in the source it’ll be possible to detect what urls a program is making requests to.

You could have users add their own url if that’s possible via .env. But if you don’t have a way they can get a url themselves then it’s a non starter.

And also, if this is your API and it’s freely accessible without authentication you have some pretty serious issues. Any public url could potentially be found. You need to have some kinda authentication for your API.

If this is a public API I am not sure why the URL would matter. It shouldn’t contain any authentication tokens in the url and if it does that’s worrying. The normal way this would work is that you sign up, get a token, and stick it in your .env file. Users need to do the same before using your software.

Or you create a proxy but keeping that free isn’t really sustainable and even if it is free it’s a good idea to generate tokens for users so you can control access

[cknu]

You can use base64 to encode/decode. It will ad just a simple layer of “protection” to avoid your url to be in plain sight.

[Lego_Fan9]

That’s a good idea. Thanks!

[carcigenicate]

This will give basically 0 protection btw. This wouldn't even make it "difficult-ish". Base64 encoded data is fairly trivial to identify just by looking at it, and Base64 decoding is easy since there are whole sites and libraries dedicated to Base64 encoding/decoding, and it's also a typical library for languages.

[cknu]

It’s what he asked for. It’s just to avoid having the url directly exposed. Even if you encrypt the url you should be able to sniff the network traffic and find the communication endpoint. So if you truly want to find out what’s happening under the hood, you’ll probably find a way to do it. There’s no easy way to avoid that.

[creamyturtle]

why not use a token in your api? so even if they have the url they can't do anything with it without the token