DEV Community: Reincoder

You shouldn’t put your IPinfo token in the frontend! Or, should you….?

Reincoder — Thu, 22 Dec 2022 21:37:18 +0000

How to secure your IPinfo token on the frontend, a brief primer on filtering referring domains.

The classic advice of API access tokens is that you should NEVER put your API access token in the frontend or website directly. This is very true. It is fairly easy to extract an API access token from the frontend. All you have to do is open up the DevTools and…. I digress.

Let’s see how you can secure your IPinfo.io IP geolocation access token, if you have put it directly on your website’s frontend.

API Access Token in the frontend?

What if, for convenience or for speed or for any reason, you need to put your API access token in the front-end.

For example:

Let’s say you want to see if a visitor of your website is based in the EU zone, and therefore your site is now subjected to the GDPR regulations. Now, GDPR comes with a whole host of user privacy related rules and regulation.

To check whether a visitor is from Europe you can check it using their IP address and IPinfo. Once you are sure that the user is from a country that is covered under GDPR regulation, you can ask the visitor to agree to your privacy statement, redirect them to another page, or you can simply block their access to your site. It is your choice.

Should you put your IPinfo Token in the frontend?

Now, how can you find out where the user is from. It is quite simple with IPinfo. IPinfo takes the visitor’s IP address and provides you with their geolocation information.

Now, you can instantly get the visitor’s geolocation (city, region, country) from their IP address using IPinfo’s API services and make any kind of decision necessary. IPinfo has a ton of resources to get you started.

But you need to put your access token in the backend, right? Well, putting your access token in the backed is the best practice. However, if:

you have a static site with no backend
you want instant geolocation confirmation
you want to block the user from accessing your site based on geolocation
you want to redirect the user to another page based geolocation
you want to change the language to suite the user's geolocation based preferences
you need to update taxes, shipping costs or prices based on geolocation

or if you have any specific needs or wants, you might need to put the IPinfo access token in the front end.

But the important part is doing it safely!

IPinfo provides an added level of token security with their domain and IP address filtering security measures.

IPinfo Token Security

After you signed up for IPinfo, visit:

🔗 https://ipinfo.io/account/token
Or you can go to your dashboard, click on the token section and scroll to the bottom.

Now you have two options to secure your website:

Whitelist Referring Domains
White Requesting IPS

But for this case, you will need to use the “whitelist referring domains” security measure.

Whitelist Referring Domains

This is one of the simplest way to block/allow API requests using your token based on the domain name.

Simply add your website to the input field of the “Whitelist Referring Domains” and “Save” the settings.

So how does it work? After this setup, requests using IPinfo Access Token will be limited to only your website (domain) or to any other website domains you may mention there. This includes the subdomains as well.

This is done with the Referer HTTP Header of the request. The “Referer header” is a kind of header that shows, from which domain, the request has originated from.

IPinfo will simply allow only API requests containing the referrer header domains you have set.

This is not exactly foolproof, as HTTP headers can be modified. But it is better than nothing.

Conclusion

TLDR: visit: https://ipinfo.io/account/token, put your domain name in the “Whitelist Referring Domains” and save.

IPinfo’s Token security features, makes your token security a bit more enhanced, but it isn’t 100% secure. You should always consider putting your token in the backend, where access to it can be limited and controlled. You can even select from which IP addresses the IPinfo service can be using your token. Visit the FAQ section to learn more.

Getting hired as a DE (Data Engineer)

Reincoder — Sun, 28 Aug 2022 12:14:00 +0000

If you are applying to an entry-level Data Engineering role and you are being interviewed exclusively by someone who is from the engineering or data team, the recruiters only have two criteria-

They need a few basic DE specific skills
They need something that they NEED

1. The few thangs!

The standard DE tools are Airflow, SQL, Python+Pandas, and dbt. And you need to cover a DE cloud stack. For GCP it is: BQ and Cloud Storage. For the ETL process, it could be anything: Cloud Function, Compute Engine or Dataflow.

BI tool... to be honest, you don't need a BI tool that much in DE. The BI tool domain is a slippery slope for DEs because the list of BI tools is endless and BI is a distinct field from DE. A serious recruiter wouldn't demand anything other than that you have heard of the tool they are using. But it is always good if you have built a dashboard or something, but in my opinion, it isn't super necessary.

It's almost the same advice for Spark or Kafka. Get an understanding of what they do, and have some idea of the syntax. If the data team is using Spark or Kafka, they wouldn't expect you to touch those projects in your first 2-3 months.

2. The need

I think you can get operational knowledge of the basic DE skillset in 6 months. But the catch is the NEED factor. The NEED factor can be many things. Every company is different, and they all need that thing that makes them different.

Like Scala. If you know Scala and someone is using Scala in their stack, they will try their absolute best to hire you even if you don't have the hands-on Spark experience. If they are using something like Rust, where there are only a handful of DEs who use Rust, they will try to hire you.

If they are using a method extensively that is often not prioritized in DE, they will try to hire for it. In my case, it is web scraping. Because I am confident in my web scraping skills, companies with large web scraping operations try their best to hire me even though I don't have much DE experience. I also got a few interviews because they were dealing with obscure documentation. I said, I have built a project based on the OLD YouTube API docs (those who knows, knows). They tried their best to hire me.

Now the interesting part is that BI/Dashboard and Spark/Kafka fit in here. In my opinion, they don't fall under the basic needs criteria. These are specialized needs for some DE teams. If you have used them or built projects using them, you would have an edge in a team that uses those tools extensively. But they wouldn't give you an edge everywhere, as not all DE teams use them.

That need factor is why some DE recruiters would prefer to have programmers instead of data analysts or vice-versa, because the skillset a recruit brings meets their specific needs.

To summarize...

Essentially, I am saying the need criteria is so diverse, you can't predict your way into it. So specialize in something that relates to DE that you enjoy.

It sounds like feel-good advice, but that is just what I figured. Someone who is able to write Java shouldn't focus on building dashboards; they can focus on learning Scala or Rust. If you have data analytics or BI interests, you are wasting your time if you attempt to learn Scala without getting paid for it.

Author: anyfactor, DevRel at IPinfo.io | The views and opinion expressed here are personal :)

IP Address Geolocation data with Python in under 30 Seconds

Reincoder — Wed, 24 Aug 2022 09:44:00 +0000

IPinfo’s IP Address API service that keeps it simple. Whether it is making requests to the API or using the official Python library you can get up and running in no time.

The API service allows you to get tons of data and insights from an IP address including -
🗺 Geolocation data
🌎 ISP, hosting and company related data
🔐 Privacy and security data like VPN, Tor and Proxy usage

The IPinfo’s API gets you what you need in no time. They are pretty generous with their free tier too - they provide up to 50,000 free geolocation requests per month. Even better, no credit card is required and you can signup with your Google or Github account in under few seconds.

So start the clock and let’s see if it is possible to get IP address data in under 30 seconds!

Signing up to IPinfo & getting your access token (<10 Seconds)

You can use your Google account or your GitHub account
Go to your dashboard and copy your access token from the bottom of the page!

Installing the Python Module (<15 Seconds)

Assuming you have Python and Pip installed properly -

Install the IPinfo Python module using pip-

pip install ipinfo
Once installed you are ready to go!
To use the Python Module -

Import → initialize the handler → getting information from the IP address using the handler.

import ipinfo

# get your access token from your dashboard
access_token = '0df49bbbc5e4eb'

# initialize the handler
handler = ipinfo.getHandler(access_token)

# declare the IP address
ip_address = '216.239.36.21' 

details = handler.getDetails(ip_address)

print(details.all)

If you can write as fast me (I doubt that 😎) you can even do all that in less than 20 seconds. Want me to prove it?

So what kind of information you can get from a mere IP Address? Lots of information actually.

Here is the full data output

{
  'ip': '216.239.36.21',
  'hostname': 'any-in-2415.1e100.net',
  'anycast': True,
  'city': 'Mountain View',
  'region': 'California',
  'country': 'US',
  'loc': '37.4056,-122.0775',
  'postal': '94043',
  'timezone': 'America/Los_Angeles',
  'asn': 
    {
      'asn': 'AS15169',
      'name': 'Google LLC',
      'domain': 'google.com',
      'route': '216.239.36.0/24',
      'type': 'business'
     },
   'company':
     {
       'name': 'Google LLC',
       'domain': 'google.com',
       'type': 'business'
     },
   'privacy':
     {
       'vpn': False, 
       'proxy': False,
       'tor': False,
       'relay': False,
       'hosting': False,
       'service': ''
     }, 
  'country_name': 'United States',
  'latitude': '37.4056',
  'longitude': '-122.0775'
}

You can also access individual data by calling specific functions

>> details.city
'Mountain View'
>> details.country
'US'
>> details.asn
{'asn': 'AS15169',
 'name': 'Google LLC',
 'domain': 'google.com',
 'route': '216.239.36.0/24',
 'type': 'business'}
>> details.asn
'37.4056,-122.0775'

Now, if you want to get even faster you could try out our brand-spanking-new IPinfo CLI. It lets you skip all that Python stuff and get all the information from your terminal.

Want to reach out to me? Hit me up on Twitter at @anyfactor