Can someone do a CRSF attack on my youtube channel with my api key?

Vote count:

0

So I am building a simple AJAX app that gets thumbnails from YouTube videos from my playlist that uses requests like this in the JavaScript:

GET http://ift.tt/1AAKxvl}

But of course anyone who can view source can see my API key. YouTube says that API keys are not used for authorization, so theoretically there should be no reason not to include it in a client-side app. BUT YT API guide also says you can use the API key to do things like add videos to a playlist.

I have the REFERRER set to my own URL of course. But it seems it would not be too hard to fake a referrer on an xmlhttp request. By making my API public, am I making myself vulnerable to someone putting pron on my playlist or something?

asked 1 min ago

user3557096

15

Can someone do a CRSF attack on my youtube channel with my api key?