Improving the security of Google APIs with SSL
We at Google go to great lengths to ensure every step is taken to protect
our users’ data. As part of our ongoing effort to improve security everywhere, we will start
requiring the use of SSL in many products. Requiring SSL improves security by encrypting data
communications between users and Google, better protecting it from being intercepted by a
malicious third party.
Some of these changes have already occurred.
Many user-facing Google products now allow or require SSL, including
encrypting
Google web search,
defaulting
to SSL in Gmail, and requiring SSL in Google Docs. Next on our list is to improve
SSL support for our developer facing APIs. For most APIs, our technical documentation, client
libraries and code samples already use SSL. Many new APIs and versions will be SSL only.
Further, the
Google Maps
API, which previously offered SSL only to Premier customers, is offering SSL to all
developers starting today.
Additionally, beginning September 15, 2011,
Google will require that all users of
Google Documents List API,
Google Spreadsheets
API, and
Google Sites
API use SSL connections for all API requests. Specifically, this change will
disallow all HTTP requests, responding with an HTTP 400 Bad Request response. API requests
will only be accepted via HTTP
S. For example, a request to
http://docs.google.com/feeds/default/private/full
will no longer pull a list of a user's documents. Instead, a request must be made to
https://docs.google.com/feeds/default/private/full.
This change should be transparent if you're using the most recent version of
the
Google Data
client libraries, since they already use SSL for all requests. If you're not using
the latest version, then please upgrade as soon as possible. If you're not using our client
libraries, then simply change any use of an HTTP URL to its corresponding HTTPS version in
your code. Your existing OAuth and AuthSub tokens will continue to work using the HTTPS URLs,
even if they were requested with a scope that uses an ‘http://’ scheme.
Although we’re initially requiring SSL for only a few APIs (those whose traffic was
already mostly over SSL), we strongly recommend that you convert all your API clients as soon
as possible to help protect your users’ data. Check the
documentation for each API for more
information about that API's SSL support, including the updated
Google
Documents List API documentation,
Google
Spreadsheets API documentation, and
Google
Sites API documentation.
If you have any questions or
concerns about this change, please follow up in the forums of the API you are using.
By Adam
Feldman, Google Developer Team
