5 ms·

I love this. Thanks for adding the free image export option! A word of warning: Your Foursquare API client ID and Secret are completely visible to anyone and c

by verst 9y ago

I love this. Thanks for adding the free image export option! A word of warning: Your Foursquare API client ID and Secret are completely visible to anyone and can easily be abused. [1] Also, currently the client ID is exceeding its rate limit, so I cannot add my own locations. [1] You are making these kinds of requests: https://api.foursquare.com/v2/venues/suggestCompletion?query=Benaroya%20H&ll=47.6,-122.3&v=20180101&limit=10&client_id=XXXXX&client_secret=XXXXX https://api.foursquare.com/v2/venues/suggestCompletion?query...

verst 9y ago
Possible solution: Maybe proxy your Foursquare API requests via https://www.eliotand.me/airbnb-poster/search https://www.eliotand.me/airbnb-poster/search or a similar API endpoint you'd create. Disallow CORS on that new API endpoint. You can keep the API call signature but remove the client ID and secret. On your backend you can then make those Foursquare API requests and add the client ID and secret to the request.
- xrjn 9y ago
  I built a microservice that does something similar[0] for Mailchimp. They have an API that requires a secret key, but we didn't want to keep a server running for it (and obviously didn't want anyone on the internet playing with our key). So I set up a little python service that serves a page and 'proxies' the API to the end user. [0] https://github.com/sasha42/Mailchimp-utility https://github.com/sasha42/Mailchimp-utility
  - verst 9y ago
    Very nice! You could also do this simply by running on Azure Functions (free consumption plan). All you need to deploy is a simple proxies.json, see [1]. On the AWS side it appears you can entirely use API Gateway. Here [2] is a Swagger 2.0 definition file I just wrote which upon import creates an API endpoint that should proxy requests to an external API while adding your secret credentials. [1]: https://aka.ms/apiproxy https://aka.ms/apiproxy [2]: https://gist.github.com/berndverst/b59fa0b38544f13c05ae0b77f21d9939 https://gist.github.com/berndverst/b59fa0b38544f13c05ae0b77f...
    - verst 9y ago
      And for posterity, here is to create this kind of API proxy in Azure Functions. It's even easier! https://gist.github.com/berndverst/37d87570418bbee77641777e13bc10c9 https://gist.github.com/berndverst/37d87570418bbee77641777e1...

by verst 9y ago

verst 9y ago

Possible solution: Maybe proxy your Foursquare API requests via https://www.eliotand.me/airbnb-poster/search https://www.eliotand.me/airbnb-poster/search or a similar API endpoint you'd create. Disallow CORS on that new API endpoint. You can keep the API call signature but remove the client ID and secret. On your backend you can then make those Foursquare API requests and add the client ID and secret to the request.

xrjn 9y ago
I built a microservice that does something similar[0] for Mailchimp. They have an API that requires a secret key, but we didn't want to keep a server running for it (and obviously didn't want anyone on the internet playing with our key). So I set up a little python service that serves a page and 'proxies' the API to the end user. [0] https://github.com/sasha42/Mailchimp-utility https://github.com/sasha42/Mailchimp-utility
- verst 9y ago
  Very nice! You could also do this simply by running on Azure Functions (free consumption plan). All you need to deploy is a simple proxies.json, see [1]. On the AWS side it appears you can entirely use API Gateway. Here [2] is a Swagger 2.0 definition file I just wrote which upon import creates an API endpoint that should proxy requests to an external API while adding your secret credentials. [1]: https://aka.ms/apiproxy https://aka.ms/apiproxy [2]: https://gist.github.com/berndverst/b59fa0b38544f13c05ae0b77f21d9939 https://gist.github.com/berndverst/b59fa0b38544f13c05ae0b77f...
  - verst 9y ago
    And for posterity, here is to create this kind of API proxy in Azure Functions. It's even easier! https://gist.github.com/berndverst/37d87570418bbee77641777e13bc10c9 https://gist.github.com/berndverst/37d87570418bbee77641777e1...