Add tooltips on API key restriction usage (IPs & referers).

NREL · Aug 13, 2015 · 45c9348 · 45c9348
1 parent 3afb7bb
commit 45c9348
Show file tree

Hide file tree

Showing 3 changed files with 16 additions and 2 deletions.
diff --git a/app/assets/javascripts/admin/templates/apis/settings_allowed_ips_fields.hbs b/app/assets/javascripts/admin/templates/apis/settings_allowed_ips_fields.hbs
@@ -1,5 +1,6 @@
 {{input allowedIpsString as='text'
   class='row-fluid'
-  label='Restrict Access to IPs'
+  labelTranslation='mongoid.attributes.api/settings.allowed_ips'
+  tooltipTranslation='admin.api.settings.allowed_ips_tooltip_markdown'
   placeholder='10.0.0.0/8'
   inputConfig='class:span12'}}
diff --git a/app/assets/javascripts/admin/templates/apis/settings_allowed_referers_fields.hbs b/app/assets/javascripts/admin/templates/apis/settings_allowed_referers_fields.hbs
@@ -1,5 +1,6 @@
 {{input allowedReferersString as='text'
   class='row-fluid'
-  label='Restrict Access to HTTP Referers'
+  labelTranslation='mongoid.attributes.api/settings.allowed_referers'
+  tooltipTranslation='admin.api.settings.allowed_referers_tooltip_markdown'
   placeholder='*.example.com/*'
   inputConfig='class:span12'}}
diff --git a/config/locales/en.yml b/config/locales/en.yml
@@ -258,6 +258,18 @@ en:
           code: OVER_RATE_LIMIT
           message: You have exceeded your rate limit. Try again later or contact us at {{contactUrl}} for assistance
           ```
+        allowed_ips_tooltip_markdown: |-
+          Restrict this API key so that it may only be used from the specified IP addresses.
+
+          Single IP addresses may be given (`10.20.30.40`) or IP ranges may be given in CIDR notation (`10.0.0.0/8`).
+
+          Multiple IP addresses can be allowed by entering each one on a new line.
+        allowed_referers_tooltip_markdown: |-
+          Restrict this API key so that it may only be used when the specified URLs are present in the `Referer` HTTP header. This can be used to prevent an API key from being reused on other client-side web applications that don't match this URL (but note that this does not prevent server-side reuse where the referer could be forged).
+
+          A full URL may be given (`https://example.com/foo`), or wildcards can be used (`*.example.com/*`).
+
+          Multiple referers can be allowed by entering each one on a new line.
       sub_settings:
         legend: Sub-URL Request Settings
         note: Change settings for specific sub-URLs within this API.