OpenWeatherMap URL Token

ID

openweathermap_url_token

Severity

low

Vendor

OpenWeatherMap

Family

API Token

Description

OpenWeatherMap is an online service, owned by OpenWeather Ltd, that provides global weather data via API, including current weather data, forecasts, nowcasts and historical weather data for any geographical location. The company provides a minute-by-minute hyperlocal precipitation forecast for any location.

The service is reachable through an API using a token to authenticate.

Security

Any hardcoded OpenWeatherMap Token is a potential secret reported by this detector.

Accidentally checking-in the key to source control repositories could compromise your OpenWeatherMap account.

Examples

var url = 'http://api.openweathermap.org/data/2.5/weather?q=London,UK'+
     *    '&APPID=7bbbb47522846e8b3c26ba35c226c734';

Mitigation / Fix

  1. Remove the Token from the source code or committed configuration file.

  2. Follow your policy for handling leaked secrets, which typically require revoking the secret in the target system(s). Go to your account API Keys tab to revoke the token.

  3. If under a git repository, you may remove unwanted files from the repository history using tools like git filter-repo or BFG Repo-Cleaner. You may follow the procedure listed here for GitHub.

You should consider any sensitive data in commits with secrets as compromised.

Remember that secrets may be removed from history in your projects, but not in other users' cloned or forked repositories.

Reference

https://openweathermap.org/api