显然 flutter_google_places 需要代理服务器？

Question

Okay, I must be an unbearable noob to iOS programming, using API's or using XCode in general, because apparently changing the API-Keys in my program to any sort of Restricted API Key breaks my program.

I'm building my app using flutter (Writing most of the code in VSCode).

In my pubspec.yaml I have the following dependencies (Just incase it's relevant).

dependencies:
  flutter:
    sdk: flutter
  firebase_auth: ^0.15.4
  google_sign_in: ^4.1.4
  firebase_core: 0.4.4
  google_maps_flutter: ^0.5.24+1
  geolocator: ^5.3.0
  flutter_google_places: ^0.2.4
  geocoder: ^0.2.1
  http: ^0.12.0+4
  intl: ^0.16.1

If I use the unrestricted Web API Key for my program, as the googleMapKay, I have no problems, and the following code works perfectly.

  Future<void> _originAutocomplete() async {
    Prediction p = await PlacesAutocomplete.show(
        context: context,
        apiKey: googleMapKey,
        mode: Mode.overlay, 
        language: "en",
        location: new Location(last_known_position.latitude, last_known_position.longitude),
        radius: 100000,
        components: []);
        if (p == null) {
          print('p is null');
        }
    originSelected(p);
  }

If however I use the ios-app Restricted API-Key for the same line, p is suddenly null. Now I am using firebase, and I've included the GoogleServices.plist in the program correctly. I've updated the API-Key in my AppDelegate.swift in XCode as well, and also updated the API-Key in the program itself.

I've been testing this on a vairety of devices, iphone se, 5s, 8+, and on simulators for ipad pro 12.9" (third generation), and iphone 11 pro max. In all cases, I have the same error, AND it's fixed when using the unrestricted web API's, which I cannot use in the final release build of the product.

I did also verify that the Restricted API-Key is set to only restrict via iOS apps, and that the bundle-identifier of the program is correctly set inside the google API-Key restrictions. (And that there is only application resrictions, no api-restrictions). So I don't THINK that is the problem, but if you can show me a way to test, then I'd appreciate! After a little testing I found the copy of the key inside the AppDelegate file doesn't seem to matter, so that one can be restricted without an issue.

After looking into the documentation for flutter_google_places, apparently this has an innate dependancy for google_maps_webservices which requires a web-api to function. (If I understand correctly this means an unrestricted key?). This does state that the "correct" industry best-practice would be to use a proxy server?

I'm not 100% familiar with this process, or how to do it, or if there's any simple or easy methods to get this working, so any assistance you can provide would be MUCH appreciated!

Answer 1

Google Maps Platform APIs needs to have API key in the request to work properly. API keys are recommended to have restrictions set on them to secure and protect your keys. Please note that there are different type of restrictions that you can use for your API key and these restrictions should match the appropriate services that are using it, or else, it will throw an error.

I can see that you are using the Google places autocomplete widgets for flutter and this seems to use the Places webservice API. Please know that Places Webservice API is not compatible with iOS restrictions since the APIs/SDKs that can only use this restriction is Places SDK for iOS and Maps SDK for iOS . This might be the reason why you are having the issue when using an iOS restricted API key. You might consider just using an API restriction and restrict your key with the Google Maps Platform API your flutter app is using.

Also, on mobile apps that uses Web Service APIs, you can consider the following technics to safeguard yur API keys: Use a proxy server, Obfuscate or encrypt the API key or signing secret and Use CA pinning or certificate pinning to verify the server resources are valid. These are discuss in this link .