What is the best way to authenticate using a key in a query string?I have a web service that clients can consume if they provide a authentication key in the query string.  I also have a web front-end that consumes the web service as well.  I do not want to embed the authentication key in javascript where someone can actually see what the key is. My solution was to have my web client NOT provide the key and the server side code check to see if the request.header referrer is localhost (it resides on the same server) and if it is, don't require an auth key.  Are there issues with this?  Can someone modify the referrer in a request header?  Here is my server side code.  I am using CherryPy:HOSTNAME_LOCAL = { , acme.com, localhost }def _get_hostname(self):    if Referer in cherrypy.request.headers:        referer = cherrypy.request.headers[Referer]    if referer == None:        hostname =     else:        ext = tldextract.extract(referer)        if ext.suffix == :            hostname = ext.domain        else:            hostname = ext.domain + . + ext.suffix        return hostname    raise ValueError(Error: referer in request.headers is None)def authenticate(self, key=None):    if key is None:        hostname = self._get_hostname()        if hostname in HOSTNAME_LOCAL:            return True, Authorization Key Not Required.    return False, Authorization Denied. Authorization Key Required.secure, msg = self.data.authenticate(key)return secure, msg
Web Security with Authentication Key in Query String
python;security;authentication;cherrypy