Sending api key as a request header and not in the request url (#1403)

Author: ankitaj224

firebase-installations/gradle.properties

@@ -1,2 +1,2 @@
-version=16.2.0
-latestReleasedVersion=16.1.0
+version=16.2.1
+latestReleasedVersion=16.2.0

firebase-installations/src/main/java/com/google/firebase/installations/remote/FirebaseInstallationServiceClient.java

@@ -77,6 +77,8 @@ public class FirebaseInstallationServiceClient {
 
   private static final String X_ANDROID_IID_MIGRATION_KEY = "x-goog-fis-android-iid-migration-auth";
 
+  private static final String API_KEY_HEADER = "x-goog-api-key";
+
   private static final int NETWORK_TIMEOUT_MILLIS = 10000;
 
   private static final Pattern EXPIRATION_TIMESTAMP_PATTERN = Pattern.compile("[0-9]+s");
@@ -133,13 +135,12 @@ public InstallationResponse createFirebaseInstallation(
     URL url =
         new URL(
             String.format(
-                "https://%s/%s/%s?key=%s",
+                "https://%s/%s/%s",
                 FIREBASE_INSTALLATIONS_API_DOMAIN,
                 FIREBASE_INSTALLATIONS_API_VERSION,
-                resourceName,
-                apiKey));
+                resourceName));
     while (retryCount <= MAX_RETRIES) {
-      HttpURLConnection httpURLConnection = openHttpURLConnection(url);
+      HttpURLConnection httpURLConnection = openHttpURLConnection(url, apiKey);
 
       try {
         httpURLConnection.setRequestMethod("POST");
@@ -249,15 +250,14 @@ public void deleteFirebaseInstallation(
     URL url =
         new URL(
             String.format(
-                "https://%s/%s/%s?key=%s",
+                "https://%s/%s/%s",
                 FIREBASE_INSTALLATIONS_API_DOMAIN,
                 FIREBASE_INSTALLATIONS_API_VERSION,
-                resourceName,
-                apiKey));
+                resourceName));
 
     int retryCount = 0;
     while (retryCount <= MAX_RETRIES) {
-      HttpURLConnection httpURLConnection = openHttpURLConnection(url);
+      HttpURLConnection httpURLConnection = openHttpURLConnection(url, apiKey);
       httpURLConnection.setRequestMethod("DELETE");
       httpURLConnection.addRequestProperty("Authorization", "FIS_v2 " + refreshToken);
 
@@ -310,13 +310,12 @@ public TokenResult generateAuthToken(
     URL url =
         new URL(
             String.format(
-                "https://%s/%s/%s?key=%s",
+                "https://%s/%s/%s",
                 FIREBASE_INSTALLATIONS_API_DOMAIN,
                 FIREBASE_INSTALLATIONS_API_VERSION,
-                resourceName,
-                apiKey));
+                resourceName));
     while (retryCount <= MAX_RETRIES) {
-      HttpURLConnection httpURLConnection = openHttpURLConnection(url);
+      HttpURLConnection httpURLConnection = openHttpURLConnection(url, apiKey);
       try {
         httpURLConnection.setRequestMethod("POST");
         httpURLConnection.addRequestProperty("Authorization", "FIS_v2 " + refreshToken);
@@ -346,7 +345,7 @@ public TokenResult generateAuthToken(
     throw new IOException();
   }
 
-  private HttpURLConnection openHttpURLConnection(URL url) throws IOException {
+  private HttpURLConnection openHttpURLConnection(URL url, String apiKey) throws IOException {
     HttpURLConnection httpURLConnection = (HttpURLConnection) url.openConnection();
     httpURLConnection.setConnectTimeout(NETWORK_TIMEOUT_MILLIS);
     httpURLConnection.setReadTimeout(NETWORK_TIMEOUT_MILLIS);
@@ -363,6 +362,7 @@ private HttpURLConnection openHttpURLConnection(URL url) throws IOException {
       }
     }
     httpURLConnection.addRequestProperty(X_ANDROID_CERT_HEADER_KEY, getFingerprintHashForPackage());
+    httpURLConnection.addRequestProperty(API_KEY_HEADER, apiKey);
     return httpURLConnection;
   }