I’ve been supporting a team with integrating / uploading into Transloadit. In other environments we can simply upload using the Auth Key, however in Android SDK and iOS it requires the secret also be given. This means that The Android / iOS app can be reverse engineered to retrieve the secret and the attacker can use the secret to access data of other users (by listing out the assemblies and getting the detail of each one).
Why was it designed this way? Any way we can fix this?
So you bring up a very good point. It looks like this might be a rough spot in our documentation around both the Java SDK and the Android SDK. (I’ll need to have someone else look deeper at the iOS SDK).
Constructor for the AndroidTransloadit class in the Android SDK
Corresponding constructor from the Java SDK that AndroidTransloadit extends.
From these the secret string is nullable. So you should be able to instantiate like so and not have to leak the Transloadit secret in your app.
AndroidTransloadit transloadit = new AndroidTransloadit("key", null);
However, what ends up happening in the core JavaSDK when the secret is not set is that signature authentication is disabled. To use signature authentication without exposing the secret the Transloadit client would have to support generating signatures from a server side application. If signature authentication is not a requirement for you immediately then simply nulling the secret will be sufficient for your use case.