Get YouTube json API data on Pages template

[sobrenome]

I am trying to retrieve json API data from YouTube using this code:

{{$key = 'xxxxxxxxxxxxx';}}
{{$base_url = 'https://www.googleapis.com/youtube/v3/search';}}
{{$channel_id = $record->customFieldDisplayByKey('youtube_channel_id');}}
{{$max_results = 3;}}
{{$api_url = \IPS\Http\Url::external( $base_url )->setQueryString( array( 'order' => 'date', 'part' => 'snippet', 'channelId' => $channel_id, 'maxResult' => $max_results, 'key' => $key ) );}}
{{$videos = $api_url->request()->get()->decodeJson();}}

But the string $videos is empty.

Could not use this code:

// Create a URL object
$url = \IPS\Http\Url::external( "http://someurl.com" )->setQueryString( 'key', 'value' );

// Now fetch it and decode the JSON
try
{
    $response = $url->request()->get()->decodeJson();
}
catch( \IPS\Http\Request\Exception $e )
{
    die( "There was a problem fetching the request" );
}
catch( \RuntimeException $e )
{
    die( "The response was not valid JSON" );
}

var_dump( $response );
exit;

Because I am on a Page template that does not accept raw php.

The URL from YouTube seems to be ok (it only allows GET from my domain) :

{
  "error": {
    "code": 403,
    "message": "Requests from referer \u003cempty\u003e are blocked.",
    "errors": [
      {
        "message": "Requests from referer \u003cempty\u003e are blocked.",
        "domain": "global",
        "reason": "forbidden"
      }
    ],
    "status": "PERMISSION_DENIED"
  }
}

 

[sobrenome]

Without restrictions:

{
  "kind": "youtube#searchListResponse",
  "etag": "e7yynn8uB_ol2402PjXEO7wAOi4",
  "nextPageToken": "CAUQAA",
  "regionCode": "BR",
  "pageInfo": {
    "totalResults": 11,
    "resultsPerPage": 5
  },
  "items": [
    {
      "kind": "youtube#searchResult",
      "etag": "jznUn23q7z5iMHGhgDHVzStPO7k",
      "id": {
        "kind": "youtube#video",
        "videoId": "60B-cMqugOI"
      },
      "snippet": {
        "publishedAt": "2019-11-07T20:59:54Z",
        "channelId": "UCdOrJP8qk2A2cL9aM2VybOw",
        "title": "Probiogurt Puravida",
        "description": "Pronto em 1 minuto! O PROBIOGURT da Puravida é um alimento fermentado em pó feito a partir de leite de coco puro, elementos prebióticos e 11 diferentes ...",
        "thumbnails": {
          "default": {
            "url": "https://i.ytimg.com/vi/60B-cMqugOI/default.jpg",
            "width": 120,
            "height": 90
          },
          "medium": {
            "url": "https://i.ytimg.com/vi/60B-cMqugOI/mqdefault.jpg",
            "width": 320,
            "height": 180
          },
          "high": {
            "url": "https://i.ytimg.com/vi/60B-cMqugOI/hqdefault.jpg",
            "width": 480,
            "height": 360
          }
        },
        "channelTitle": "Puravida Superfoods",
        "liveBroadcastContent": "none",
        "publishTime": "2019-11-07T20:59:54Z"
      }
    },
    {
      "kind": "youtube#searchResult",
      "etag": "09HwUSDUdatDykcQylssLB-eAbY",
      "id": {
        "kind": "youtube#video",
        "videoId": "Rp6xWL6AiwI"
      },
      "snippet": {
        "publishedAt": "2019-11-07T20:49:45Z",
        "channelId": "UCdOrJP8qk2A2cL9aM2VybOw",
        "title": "One Nutrition Puravida",
        "description": "Um alimento, múltiplos benefícios. Elaborado com proteínas vegetais de alto desempenho (92% de biodisponibilidade), o ONE é um complexo nutritivo de ...",
        "thumbnails": {
          "default": {
            "url": "https://i.ytimg.com/vi/Rp6xWL6AiwI/default.jpg",
            "width": 120,
            "height": 90
          },
          "medium": {
            "url": "https://i.ytimg.com/vi/Rp6xWL6AiwI/mqdefault.jpg",
            "width": 320,
            "height": 180
          },
          "high": {
            "url": "https://i.ytimg.com/vi/Rp6xWL6AiwI/hqdefault.jpg",
            "width": 480,
            "height": 360
          }
        },
        "channelTitle": "Puravida Superfoods",
        "liveBroadcastContent": "none",
        "publishTime": "2019-11-07T20:49:45Z"
      }
    },
    {
      "kind": "youtube#searchResult",
      "etag": "TDjy3XttLGMCwZQK_CP1bgpNBpg",
      "id": {
        "kind": "youtube#video",
        "videoId": "kwuNS0ko38Y"
      },
      "snippet": {
        "publishedAt": "2018-10-19T16:43:53Z",
        "channelId": "UCdOrJP8qk2A2cL9aM2VybOw",
        "title": "Coconut Granola Puravida",
        "description": "O segredo de qualquer receita é a qualidade dos ingredientes. E a Coconut Granola Low Carb da Puravida é feita com os mais nobres alimentos!",
        "thumbnails": {
          "default": {
            "url": "https://i.ytimg.com/vi/kwuNS0ko38Y/default.jpg",
            "width": 120,
            "height": 90
          },
          "medium": {
            "url": "https://i.ytimg.com/vi/kwuNS0ko38Y/mqdefault.jpg",
            "width": 320,
            "height": 180
          },
          "high": {
            "url": "https://i.ytimg.com/vi/kwuNS0ko38Y/hqdefault.jpg",
            "width": 480,
            "height": 360
          }
        },
        "channelTitle": "Puravida Superfoods",
        "liveBroadcastContent": "none",
        "publishTime": "2018-10-19T16:43:53Z"
      }
    },
    {
      "kind": "youtube#searchResult",
      "etag": "mtpTXL4UgYKBtX2sLnlcxogn_mc",
      "id": {
        "kind": "youtube#video",
        "videoId": "H2739WTmO8o"
      },
      "snippet": {
        "publishedAt": "2018-10-19T16:45:09Z",
        "channelId": "UCdOrJP8qk2A2cL9aM2VybOw",
        "title": "Spirulina Premium Puravida",
        "description": "Estas microalgas são possivelmente os alimentos naturais com maior densidade nutritiva. A Spirulina e a Clorella oferecem uma altíssima riqueza e ...",
        "thumbnails": {
          "default": {
            "url": "https://i.ytimg.com/vi/H2739WTmO8o/default.jpg",
            "width": 120,
            "height": 90
          },
          "medium": {
            "url": "https://i.ytimg.com/vi/H2739WTmO8o/mqdefault.jpg",
            "width": 320,
            "height": 180
          },
          "high": {
            "url": "https://i.ytimg.com/vi/H2739WTmO8o/hqdefault.jpg",
            "width": 480,
            "height": 360
          }
        },
        "channelTitle": "Puravida Superfoods",
        "liveBroadcastContent": "none",
        "publishTime": "2018-10-19T16:45:09Z"
      }
    },
    {
      "kind": "youtube#searchResult",
      "etag": "SkmlPdjeSNdwoOHZj7RbgaWmz4Y",
      "id": {
        "kind": "youtube#video",
        "videoId": "zMdz1pLA1eE"
      },
      "snippet": {
        "publishedAt": "2018-10-19T16:42:34Z",
        "channelId": "UCdOrJP8qk2A2cL9aM2VybOw",
        "title": "Coco Cream Puravida",
        "description": "O Coco Cream é o puro leite de coco em pó instantâneo mais cremoso e delicioso do mercado! Basta adicionar uma colher na água morna e pronto!",
        "thumbnails": {
          "default": {
            "url": "https://i.ytimg.com/vi/zMdz1pLA1eE/default.jpg",
            "width": 120,
            "height": 90
          },
          "medium": {
            "url": "https://i.ytimg.com/vi/zMdz1pLA1eE/mqdefault.jpg",
            "width": 320,
            "height": 180
          },
          "high": {
            "url": "https://i.ytimg.com/vi/zMdz1pLA1eE/hqdefault.jpg",
            "width": 480,
            "height": 360
          }
        },
        "channelTitle": "Puravida Superfoods",
        "liveBroadcastContent": "none",
        "publishTime": "2018-10-19T16:42:34Z"
      }
    }
  ]
}

 

[sobrenome]

I have tried to use raw php block and checked that the issue is related to permission to access YouTube api:

array(1) { ["error"]=> array(4) { ["code"]=> int(403) ["message"]=> string(42) "Requests from referer are blocked." ["errors"]=> array(1) { [0]=> array(3) { ["message"]=> string(42) "Requests from referer are blocked." ["domain"]=> string(6) "global" ["reason"]=> string(9) "forbidden" } } ["status"]=> string(17) "PERMISSION_DENIED" } }

I have used HTTP restriction to accept only mydomain.com/*

What is the HTTP referer used by IPS?

[bfarber]

We don't explicitly pass a referrer in the request so it will probably be empty.

[sobrenome]

24 minutes ago, bfarber said:

We don't explicitly pass a referrer in the request so it will probably be empty.

What would be the preferred method to protect the key? 

[bfarber]

If you want to implement protections, you should be able to set up IP address restrictions in Google's developer console as I recall, and then set the IP address/IP address range of your server.

[sobrenome]

Cloud hosting with auto upscale does not allow this approach I guess. New instances are launched on demand with new IPs and ranges are also variable:

https://docs.aws.amazon.com/general/latest/gr/aws-ip-ranges.html

[bfarber]

The API key is an inherent security protection. Restricting to the AWS IP range is an extra layer of security. That's really the only option.