Skip to content

Commit

Permalink
update readmes and blog post
Browse files Browse the repository at this point in the history
  • Loading branch information
gladwindos committed Apr 30, 2024
1 parent 3bcc194 commit b798952
Show file tree
Hide file tree
Showing 9 changed files with 38 additions and 37 deletions.
2 changes: 1 addition & 1 deletion README.md
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
# Gateweaver

Gateweaver is an open-source API gateway designed for front-end applications, enabling secure integration with APIs that require sensitive keys. Through a simple YAML configuration file, users can define endpoints and apply essential policies like CORS, rate limiting, API key management, and JWT authentication, ensuring robust security measures are in place.
Gateweaver is an open-source API Proxy designed for front-end applications, enabling secure integration with APIs that require sensitive keys. Through a simple YAML configuration file, users can define endpoints and apply essential policies like CORS, rate limiting, API key management, and JWT authentication, ensuring robust security measures are in place.

Get started quickly with the CLI or Docker image, or take a look at some [examples](https://github.com/gateweaver/gateweaver/tree/main/examples) to see how you can leverage Gateweaver in your projects.

Expand Down
2 changes: 1 addition & 1 deletion packages/cli/README.md
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
# Gateweaver

Gateweaver is an open-source API gateway designed for front-end applications, enabling secure integration with APIs that require sensitive keys. Through a simple YAML configuration file, users can define endpoints and apply essential policies like CORS, rate limiting, API key management, and JWT authentication, ensuring robust security measures are in place.
Gateweaver is an open-source API Proxy designed for front-end applications, enabling secure integration with APIs that require sensitive keys. Through a simple YAML configuration file, users can define endpoints and apply essential policies like CORS, rate limiting, API key management, and JWT authentication, ensuring robust security measures are in place.

Get started quickly with the CLI or Docker image, or take a look at some [examples](https://github.com/gateweaver/gateweaver/tree/main/examples) to see how you can leverage Gateweaver in your projects.

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -12,9 +12,9 @@ APIs are essential in modern web development as they enable developers to integr

While some API keys, like those for Google Maps, can be safely used in client-side applications due to restrictions that limit their use to specific apps, many should never be exposed to the client and should be handled securely on the server side.

For applications without a dedicated server component, developers can use a proxy server or an API Gateway to securely make API calls while hiding API keys from the client. An API Gateway serves as a middleman between the client and the external API, allowing developers to handle the API key on the server side and proxy requests to the API.
For applications without a dedicated server component, developers can use an API Proxy to securely make API calls while hiding API keys from the client. An API Proxy serves as a middleman between the client and the external API, allowing developers to handle the API key on the server side and proxy requests to the API.

In this article, we explore how to protect API keys in React projects using [Gateweaver](https://github.com/gateweaver/gateweaver), an open-source API Gateway designed to help developers securely manage API keys and sensitive data.
In this article, we explore how to protect API keys in React projects using [Gateweaver](https://github.com/gateweaver/gateweaver), an open-source API Proxy designed to help developers securely manage API keys and sensitive data.

The complete source code for this guide is available on [GitHub](https://github.com/gateweaver/gateweaver/tree/main/examples/react-app).

Expand Down Expand Up @@ -44,7 +44,7 @@ You should now see the react app running on [http:https://localhost:5173](http:https://local

### Install Gateweaver CLI

Next, let's install the Gateweaver CLI tool, which we will use to configure and run the API Gateway.
Next, let's install the Gateweaver CLI tool, which we will use to configure and run the API Proxy.

```bash
pnpm add -D @gateweaver/cli
Expand All @@ -54,13 +54,13 @@ We install the CLI tool as a dev dependency as we only need it during developmen

### Configure Gateweaver

Next, let's create a `gateway` folder in our project where we will store our Gateweaver configuration files.
Next, let's create a folder called `proxy` in our project where we will store our Gateweaver configuration files.

```bash
mkdir gateway
mkdir proxy
```

Inside the `gateway` folder, create a new file called `gateweaver.yml`. This file will contain the configuration for our API Gateway.
Inside the `proxy` folder, create a new file called `gateweaver.yml`. This file will contain the configuration for our API Proxy.

```yaml title="gateweaver.yml"
policyDefinitions:
Expand All @@ -82,7 +82,7 @@ In this configuration file, we define an endpoint `/example` that proxies reques

### Add server environment variables

To define the environment variables referenced in the configuration file, we can create a `.env.gateweaver` file in the `gateway` folder. Make sure to add this file to your `.gitignore` file to avoid committing sensitive data to your repository.
To define the environment variables referenced in the configuration file, we can create a `.env.gateweaver` file in the `proxy` folder. Make sure to add this file to your `.gitignore` file to avoid committing sensitive data to your repository.

```bash title=".env.gateweaver"
API_KEY=example-api-key
Expand All @@ -98,17 +98,17 @@ Before we start the Gateweaver development server, let's add a script to the `pa
```json title="package.json"
{
"scripts": {
"gateway": "cd gateway && gateweaver start -w"
"proxy": "cd proxy && gateweaver start -w"
}
}
```

This script changes the directory to the `gateway` folder and runs the `gateweaver start -w` command, which starts the Gateweaver development server in watch mode on port 8080.
This script changes the directory to the `proxy` folder and runs the `gateweaver start -w` command, which starts the Gateweaver development server in watch mode on port 8080.

Now, let's start the Gateweaver development server by running the following command:

```bash
pnpm run gateway
pnpm run proxy
```

You should be able to test the `/example` endpoint by making a request to [http:https://localhost:8080/example](http:https://localhost:8080/example). The request will be proxied to [https://httpbin.org/bearer](https://httpbin.org/bearer) with the `Authorization` header set to the API key defined in the `.env.gateweaver` file. The response should be the following JSON:
Expand All @@ -120,45 +120,46 @@ You should be able to test the `/example` endpoint by making a request to [http:
}
```

## Update the React app to use the API Gateway
## Update the React app to use the API Proxy

Now that we have set up Gateweaver, let's update our React app to use the API Gateway to make requests to [https://httpbin.org/bearer](https://httpbin.org/bearer) without exposing the API key to the client.
Now that we have set up Gateweaver, let's update our React app to use the API Proxy to make requests to [https://httpbin.org/bearer](https://httpbin.org/bearer) without exposing the API key to the client.

### Add client environment variables

First, let's add the gateway URL as an environment variable in our react project. To do this in a Vite project, we can create a `.env.local` file in the root of our project and add the following line:
First, let's add the proxy URL as an environment variable in our react project. To do this in a Vite project, we can create a `.env.local` file in the root of our project and add the following line:

```bash title=".env.local"
VITE_GATEWAY_URL=http:https://localhost:8080
VITE_PROXY_URL=http:https://localhost:8080
```

Make sure to also add this file to your `.gitignore` file.

### Update the React app

Next, let's update the `App.tsx` file to make requests to the API Gateway. We will add a button that fetches data from the Gateway's `/example` endpoint and display the response on the page.
Next, let's update the `App.tsx` file to make requests to the API Proxy. We will add a button that fetches data from the Proxy's `/example` endpoint and display the response on the page.

```tsx title="src/App.tsx"
import { useState } from "react";
import "./App.css";

interface GatewayResponse {
interface ProxyResponse {
authenticated: boolean;
token: string;
}

function App() {
const [gatewayResponse, setGatewayResponse] =
useState<GatewayResponse | null>(null);
const [proxyResponse, setProxyResponse] = useState<ProxyResponse | null>(
null,
);

const handleClick = async () => {
if (gatewayResponse) {
setGatewayResponse(null);
if (proxyResponse) {
setProxyResponse(null);
return;
}

try {
const BASE_URL = import.meta.env.VITE_GATEWAY_URL;
const BASE_URL = import.meta.env.VITE_PROXY_URL;

const response = await fetch(`${BASE_URL}/example`);

Expand All @@ -169,24 +170,24 @@ function App() {

const data = await response.json();

setGatewayResponse(data);
setProxyResponse(data);
} catch (error) {
console.error(error);
}
};

const buttonText = gatewayResponse ? "Clear" : "Fetch data";
const buttonText = proxyResponse ? "Clear" : "Fetch data";

return (
<>
<h1>React App</h1>
<div className="card">
<button onClick={handleClick}>{buttonText}</button>

{gatewayResponse && (
{proxyResponse && (
<>
<h4>Response from Gateway:</h4>
<pre>{JSON.stringify(gatewayResponse, null, 2)}</pre>
<h4>Response from Proxy:</h4>
<pre>{JSON.stringify(proxyResponse, null, 2)}</pre>
</>
)}
</div>
Expand All @@ -197,13 +198,13 @@ function App() {
export default App;
```

Now, when you click the button in your React app, it will make a request to the `/example` endpoint on the API Gateway. This will proxy the request to [https://httpbin.org/bearer](https://httpbin.org/bearer) using the API key defined in the `.env.gateweaver` file. Then the response from the httpbin API will be displayed on the page:
Now, when you click the button in your React app, it will make a request to the `/example` endpoint on the API Proxy. This will proxy the request to [https://httpbin.org/bearer](https://httpbin.org/bearer) using the API key defined in the `.env.gateweaver` file. Then the response from the httpbin API will be displayed on the page:

![React App](./react-app-screenshot.png)

## Conclusion

In this tutorial, we learned how to protect API keys in React projects using Gateweaver. We set up a simple API Gateway and configured it to proxy requests to an external API. We then used the Gateway to make requests from our React app to the external API without exposing the API key to the client.
In this tutorial, we learned how to protect API keys in React projects using Gateweaver. We set up a simple API Proxy and configured it to proxy requests to an external API. We then used the Proxy to make requests from our React app to the external API without exposing the API key to the client.

Gateweaver provides additional policies such as rate limiting and jwt validation that you can use to further secure your application. You can find out more about Gateweaver and its features in the [documentation](https://gateweaver.io/docs/getting-started). There you can also find information on how to deploy Gateweaver to production.

Expand Down
2 changes: 1 addition & 1 deletion packages/docs/docs/configuration/policies/api-key.md
Original file line number Diff line number Diff line change
Expand Up @@ -38,7 +38,7 @@ Hashed API Key: b0fdc387a13a5ddd925214aac77a157ed5cf1cf8ebaca3cb056703b1af2b5891
### Security Practices

- **API Key**: Must be kept securely and not widely shared. While it serves as a private credential for accessing the API, there are use cases, such as in client-side applications, where the API Key may be exposed. In such scenarios, it's essential to understand the risks involved. Exposing an API Key can lead to unauthorized use of your API. It's recommended to implement additional security measures, such as rate limiting, to mitigate potential abuse.
- **Hashed API Key**: Can be safely stored in the API gateway's configuration file. The hash is used to verify the authenticity of the API Key without exposing the key itself. Storing the hash instead of the actual key mitigates risk, as the hash cannot be used to derive the original API Key.
- **Hashed API Key**: Can be safely stored in the configuration file. The hash is used to verify the authenticity of the API Key without exposing the key itself. Storing the hash instead of the actual key mitigates risk, as the hash cannot be used to derive the original API Key.

## Usage

Expand Down
2 changes: 1 addition & 1 deletion packages/docs/docs/getting-started.md
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@ import TabItem from "@theme/TabItem";

# Getting Started

Gateweaver is an open-source API gateway designed for front-end applications, enabling secure integration with APIs that require sensitive keys. Through a simple YAML configuration file, users can define endpoints and apply essential policies like CORS, rate limiting, API key management, and JWT authentication, ensuring robust security measures are in place.
Gateweaver is an open-source API Proxy designed for front-end applications, enabling secure integration with APIs that require sensitive keys. Through a simple YAML configuration file, users can define endpoints and apply essential policies like CORS, rate limiting, API key management, and JWT authentication, ensuring robust security measures are in place.

Get started quickly with the CLI or Docker image, or take a look at some [examples](https://github.com/gateweaver/gateweaver/tree/main/examples) to see how you can leverage Gateweaver in your projects.

Expand Down
2 changes: 1 addition & 1 deletion packages/docs/docusaurus.config.ts
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ import type * as Preset from "@docusaurus/preset-classic";

const config: Config = {
title: "Gateweaver",
tagline: "An open-source API Gateway for front-end applications",
tagline: "An open-source API Proxy for front-end applications",
favicon: "img/logo.png",

// Set the production url of your site here
Expand Down
2 changes: 1 addition & 1 deletion packages/docs/src/components/HomepageFeatures/index.tsx
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@ const FeatureList: FeatureItem[] = [
title: "Easy Configuration",
description: (
<>
Set up your API gateway with ease using a simple YAML file. Get started
Set up your API Proxy with ease using a simple YAML file. Get started
quickly, letting you focus on development.
</>
),
Expand Down
4 changes: 2 additions & 2 deletions packages/docs/src/pages/index.tsx
Original file line number Diff line number Diff line change
Expand Up @@ -32,8 +32,8 @@ function HomepageHeader() {
export default function Home(): JSX.Element {
return (
<Layout
title="Gateweaver, An open-source API Gateway for front-end applications"
description="An open-source API Gateway for front-end applications"
title="Gateweaver, An open-source API Proxy for front-end applications"
description="An open-source API Proxy for front-end applications"
>
<HomepageHeader />
<main>
Expand Down
2 changes: 1 addition & 1 deletion packages/server/README.md
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
# Gateweaver

Gateweaver is an open-source API gateway designed for front-end applications, enabling secure integration with APIs that require sensitive keys. Through a simple YAML configuration file, users can define endpoints and apply essential policies like CORS, rate limiting, API key management, and JWT authentication, ensuring robust security measures are in place.
Gateweaver is an open-source API Proxy designed for front-end applications, enabling secure integration with APIs that require sensitive keys. Through a simple YAML configuration file, users can define endpoints and apply essential policies like CORS, rate limiting, API key management, and JWT authentication, ensuring robust security measures are in place.

Get started quickly with the CLI or Docker image, or take a look at some [examples](https://github.com/gateweaver/gateweaver/tree/main/examples) to see how you can leverage Gateweaver in your projects.

Expand Down

0 comments on commit b798952

Please sign in to comment.