Referer parameter

[lukBakTsh]

Question

How to use the referer parameter correctly?
If this parameter works only for the Web, how can I restrict access to the key for the Android/iOS app?

My current settings:

<GooglePlacesAutocomplete
  referer="http://example.com"
/> 

and http://example.com item in the GCP -> Application restrictions -> HTTP referrers for Google Places API

Response

API keys with referer restrictions can not be used with this API

Where is this problem happening

• iOS
• Android

If you are using expo please indicate here:

• I am using expo

Version Information

• Library Version: 1.6.1

[bell-steven]

Hey @lukBakTsh thanks for the report and for following the issue template.
I just tried this, and this is definitely an issue. This was added recently (before I started maintaining the package, so I never tested this).

I pinged the author of the PR for this, i'll update this if/when I hear back.

[sapter]

@bell-steven
The prop referrer is correct. Meaning that the Places API being intended by Google to be for web does accept that prop. That said, it is true that using it in an iOS/Android app makes no sense and will not pass the referrer validation. That is because the whole idea of adding that prop is to restrict the use of your API key to only those who come from your own website/webapp. However, adding that restriction in a (non-web) app defeats that purpose as you're NOT coming from ANY website - instead, you're coming from an app. However, it will work in web apps and React Native Web

In short, the prop works as intended and referrer="http://example.com" does indeed check if you came from example.com, and correctly returns API keys with referrer restrictions can not be used with this API because it cannot determine what website you came from because you didn't come from a website but from an app.

What to do?
One option is to leave as is and rely on developers to have the common sense to not add referrer restrictions in native apps and only use it in web apps. Another option is to make it fool-proof and add the referrer restriction only in web apps. I've created a PR for that. See #561

[bell-steven]

@lukBakTsh I removed the referrer prop, as there doesn't seem to be any way to make it work without the Google SDKs.