Google makes breaking change to publishing Sheets as data | Hacker News Reader

Google makes breaking change to publishing Sheets as data

issuetracker.google.com

90 pointsdonohoe21 comments

Open articleView on HN

Link requires google account, anyone have a synopsis?

Created issue. A short description of the issue:

Private Sheet public CSV export requires authentication when set not to

What steps will reproduce the problem?

1. create a private(!) Google Sheet

2. set public CSV export publication

3. access the endpoint without credentials

What is the expected output? What do you see instead? If you see error messages, please provide them.

You should receive a CSV file, you get HTML5 login form.

Please provide any additional information below.

Setting the Sheet to Public with a link fixes the problem, there's an obvious bug with the permissions taken from the Sheet, not the Export.

Thanks! Perhaps the issuetracker and sheets teams will be able to work together on a new permission-less access policy. ;)

Someone reported the bug, a @google.com replies verifying they reproduced it and have forwarded internally (attaching a private "blocked by" bug).

So it sounds like they accept this is an issue.

Note that a comment further down says:

> I have heard that this appears to not be a bug, rather an intentional change that they didn't announce in advance.

Not sure where "I have heard" comes from, but

Huh, so when it comes to getting a URL to sheets as CSV, going through the GUI (i.e. going into the Publish to Web dialog) is no better than just using the endpoint of `https://docs.google.com/spreadsheets/d/KEY/export?format=csv...`, which also requires authentication if the underlying sheet is set to private.

Sharing resources from web applications securely is hard work. It doesn’t surprise me at all that they end up having to lock down some forms of access from time to time. Most likely they found a vulnerability and this was a side effect of mitigating it.

Title "Google makes breaking change to publishing Sheets as data" is slightly misleading/speculative as to intent.

Linked page title is "Private Sheet public CSV export requires authentication"

with a reply from Google: "This has been forwarded internally, any updates will be posted here."

Reminds me of the CORS issue from few months back - https://support.google.com/docs/thread/56845119?hl=en

Wow! I used this api a few months ago and it was really helpful. Of course I knew it was undocumented and could break at any time; here we are.

Shouldn't an integration that relied on this sort of things simply have been done properly using the sheets API to begin with?

The bug to me seems that it was ever possible to access data in a private sheet without authentication.

Is this what broke http://timeline.knightlab.com/ ?

This broke our production app last week. The only solution was to move our CSVs off of Sheets completely.

Why? Couldn't you have just set them to public view access?

Seems like it would have been a drastically simpler change.

Removing an external dependency on Google is a sound engineering choice for many use cases (and maybe not for others). One reason it might a sound engineering choice is what happened here.

Sure moving off Google is work. So is implementing the work around. Breaking changes always either require work or make user code obsolete. Breaking changes generate work for users. They externalize the cost of making changes non-breaking to end users.

Fortunately it was a transition we'd already talked about making; we were approaching that threshold where the agility/reliability tradeoff was about to flip. But still, it sucked having a few hours of unexpected downtime while we scrambled to make the change.

We didn't know about that workaround at the time, we just needed to get our app back online.

OR a CI step using the docs CLI?

This also broke my dashboard... which got bunch of data from spreadsheet :/

Reply on news.ycombinator.com