Also, your API key may be at risk if you append it to a URL that you proxy. For instance, we're doing this proxying with Tumblr (sans API key, fortunately) and

Also, your API key may be at risk if you append it to a URL that you proxy. For instance, we're doing this proxying with Tumblr (sans API key, fortunately) and they occasionally issue a 302 redirect and tack on some parameters. (for caching reasons, I assume) The 'Location' header that is sent back would have your API key in it, so you'd need to detect that and strip it out. Also, if they throw a 500 error they may echo your URL back at you. I'd probably move this code up into this application layer unless you're very sure about the API you're using.