6 ms·

In my personal view, this seems a little overbearing. If you expose an API, and you want to tell a user that they are "unauthorized" to use it, it should retur

In my personal view, this seems a little overbearing. If you expose an API, and you want to tell a user that they are "unauthorized" to use it, it should return a 401 status code so that the caller knows they're unauthorized. If you can't do that because their traffic looks like normal usage of the API by your web app, then I question why their usage is problematic for you. At the end of the day, you don't get to control what 'browser' the user uses to interact with your service. Sure, it might be Chrome, but it just as easily might be Firefox, or Lynx, or something the user built from scratch, or someone manually typing out HTTP requests in netcat, or, in this case, someone building a custom client for your specific service. If you host a web server, it's on you to remember that and design accordingly, not on the user to limit how they use your service.

AlienRobot 2y ago
That's like saying if someone accepts cash that means you should be allowed to pay a $100 bill with a thousand dimes. Just because you're right doesn't mean you aren't wrong.
- lolinder 2y ago
  The $100 tab paid in dimes causes severe inconvenience to the person trying to count them and to the person who has to take them to the bank to cash them in and wait for them to be counted again. Their very reasonable question was: if you can't distinguish the reverse engineered traffic from the traffic through your own app in order to block it, then what harm is the traffic doing? Presumably it's flying under your rate limits, and the traffic has a valid session token from a real customer. If you're unable to single it out and return a 4xx, why does it matter where it's coming from? I can think of a few reasons it might, but I'm not particularly sympathetic to them. They generally boil down to "I won't be able to use my app to manipulate the user into taking actions they'd otherwise not take." I'd be interested to hear if there are better reasons.
  - AlienRobot 2y ago
    "if you can't distinguish the reverse engineered traffic from the traffic through your own app in order to block it, then what harm is the traffic doing?" If you really believe this you'll use a custom user agent instead of spoofing Chrome. :-) Some websites use HTTP referer to block traffic. Ask yourself if any reverse engineer would be stopped by what is obviously the website telling you not to access an endpoint. I'll add that end users don't have complete information about the website. They can't know how many resources a website has to deal to reverse engineering (webmasters can't just play cat and mouse with you just because you're wasting their money) nor do they know the cost of an endpoint. I mean, most tech inclined use ad blockers when it's obvious 90% of the websites pay the cost of their endpoints by showing ads, so I doubt they would respect anything more subtle than that.
    - boolemancer 2y ago
      If an endpoint costs a lot to run, implement rate limits and return 429 status codes so callers know that they're calling too often. That endpoint will be expensive regardless of whether it's your own app or a third party that's calling it too often, so design it with that in mind. Your app isn't special, it's just another client. Treat it that way.
      - AlienRobot 2y ago
        The only reason why "another client" can exist is due to limitations of the Internet itself. If you could ensure that the web server can only be accessed by your client, you would do that, but there is no way to do this that can't be reverse-engineered. Essentially your argument is that just because a door is open that means you're allowed to enter inside, and I don't believe that makes any sense.
        TeMPOraL 2y ago
        The argument is that what you call "limitations of the Internet itself" is actually a feature, and an intended one at that. The state of things you're proposing is socially undesirable (and in many cases, anticompetitive). It's hard to extend analogies past this point, because the vision you're describing flies in the face of more fundamental social norms, and history of civilization in general.
- Bjartr 2y ago
  Not the greatest example. If someone has incurred a $100 debt to you, then, from a legal perspective, you must consider delivery of a thousand dimes as having paid the debt. You don't get a choice on that without prior contractual agreement. https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title31-section5103&num=0&edition=prelim https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim...
- Bjartr 2y ago
  Not the greatest example. If someone has incurred a $100 debt to you, then, from a legal perspective, you must consider delivery of a thousand dimes as having paid the debt. You don't get a choice on that without prior contractual agreement. https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title31-section5103&num=0&edition=prelim https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim... (In the United States at least)
  - lolinder 2y ago
    This is not an accurate reading of the code. Snopes quotes an FAQ on the US Treasury site (now missing, but presumably still correct) [0]: > Q: I thought that United States currency was legal tender for all debts. Some businesses or governmental agencies say that they will only accept checks, money orders or credit cards as payment, and others will only accept currency notes in denominations of $20 or smaller. Isn't this illegal? > A: The pertinent portion of law that applies to your question is the Coinage Act of 1965, specifically Section 31 U.S.C. 5103, entitled "Legal tender," which states: "United States coins and currency (including Federal reserve notes and circulating notes of Federal reserve banks and national banks) are legal tender for all debts, public charges, taxes, and dues." > This statute means that all United States money as identified above are a valid and legal offer of payment for debts when tendered to a creditor. There is, however, no Federal statute mandating that a private business, a person or an organization must accept currency or coins as for payment for goods and/or services. Private businesses are free to develop their own policies on whether or not to accept cash unless there is a State law which says otherwise. For example, a bus line may prohibit payment of fares in pennies or dollar bills. In addition, movie theaters, convenience stores and gas stations may refuse to accept large denomination currency (usually notes above $20) as a matter of policy. [0] https://www.snopes.com/fact-check/legal-tender-payment/ https://www.snopes.com/fact-check/legal-tender-payment/
    - Bjartr 2y ago
      I specifically said "incurred a ... debt" and "without prior... agreement". As your source says > In short, when a debt has been incurred by one party to another, and the parties have agreed that cash is to be the medium of exchange, then legal tender must be accepted if it is proffered in satisfaction of that debt. You are correct that if cash is not accepted at all, or if payment is to happen ahead of the exchange of goods or services, you are not obligated to accept arbitrary cash. And I never claimed otherwise

AlienRobot 2y ago

That's like saying if someone accepts cash that means you should be allowed to pay a $100 bill with a thousand dimes. Just because you're right doesn't mean you aren't wrong.

lolinder 2y ago
The $100 tab paid in dimes causes severe inconvenience to the person trying to count them and to the person who has to take them to the bank to cash them in and wait for them to be counted again. Their very reasonable question was: if you can't distinguish the reverse engineered traffic from the traffic through your own app in order to block it, then what harm is the traffic doing? Presumably it's flying under your rate limits, and the traffic has a valid session token from a real customer. If you're unable to single it out and return a 4xx, why does it matter where it's coming from? I can think of a few reasons it might, but I'm not particularly sympathetic to them. They generally boil down to "I won't be able to use my app to manipulate the user into taking actions they'd otherwise not take." I'd be interested to hear if there are better reasons.
- AlienRobot 2y ago
  "if you can't distinguish the reverse engineered traffic from the traffic through your own app in order to block it, then what harm is the traffic doing?" If you really believe this you'll use a custom user agent instead of spoofing Chrome. :-) Some websites use HTTP referer to block traffic. Ask yourself if any reverse engineer would be stopped by what is obviously the website telling you not to access an endpoint. I'll add that end users don't have complete information about the website. They can't know how many resources a website has to deal to reverse engineering (webmasters can't just play cat and mouse with you just because you're wasting their money) nor do they know the cost of an endpoint. I mean, most tech inclined use ad blockers when it's obvious 90% of the websites pay the cost of their endpoints by showing ads, so I doubt they would respect anything more subtle than that.
  - boolemancer 2y ago
    If an endpoint costs a lot to run, implement rate limits and return 429 status codes so callers know that they're calling too often. That endpoint will be expensive regardless of whether it's your own app or a third party that's calling it too often, so design it with that in mind. Your app isn't special, it's just another client. Treat it that way.
    - AlienRobot 2y ago
      The only reason why "another client" can exist is due to limitations of the Internet itself. If you could ensure that the web server can only be accessed by your client, you would do that, but there is no way to do this that can't be reverse-engineered. Essentially your argument is that just because a door is open that means you're allowed to enter inside, and I don't believe that makes any sense.
      - TeMPOraL 2y ago
        The argument is that what you call "limitations of the Internet itself" is actually a feature, and an intended one at that. The state of things you're proposing is socially undesirable (and in many cases, anticompetitive). It's hard to extend analogies past this point, because the vision you're describing flies in the face of more fundamental social norms, and history of civilization in general.
Bjartr 2y ago
Not the greatest example. If someone has incurred a $100 debt to you, then, from a legal perspective, you must consider delivery of a thousand dimes as having paid the debt. You don't get a choice on that without prior contractual agreement. https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title31-section5103&num=0&edition=prelim https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim...
Bjartr 2y ago
Not the greatest example. If someone has incurred a $100 debt to you, then, from a legal perspective, you must consider delivery of a thousand dimes as having paid the debt. You don't get a choice on that without prior contractual agreement. https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title31-section5103&num=0&edition=prelim https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim... (In the United States at least)
- lolinder 2y ago
  This is not an accurate reading of the code. Snopes quotes an FAQ on the US Treasury site (now missing, but presumably still correct) [0]: > Q: I thought that United States currency was legal tender for all debts. Some businesses or governmental agencies say that they will only accept checks, money orders or credit cards as payment, and others will only accept currency notes in denominations of $20 or smaller. Isn't this illegal? > A: The pertinent portion of law that applies to your question is the Coinage Act of 1965, specifically Section 31 U.S.C. 5103, entitled "Legal tender," which states: "United States coins and currency (including Federal reserve notes and circulating notes of Federal reserve banks and national banks) are legal tender for all debts, public charges, taxes, and dues." > This statute means that all United States money as identified above are a valid and legal offer of payment for debts when tendered to a creditor. There is, however, no Federal statute mandating that a private business, a person or an organization must accept currency or coins as for payment for goods and/or services. Private businesses are free to develop their own policies on whether or not to accept cash unless there is a State law which says otherwise. For example, a bus line may prohibit payment of fares in pennies or dollar bills. In addition, movie theaters, convenience stores and gas stations may refuse to accept large denomination currency (usually notes above $20) as a matter of policy. [0] https://www.snopes.com/fact-check/legal-tender-payment/ https://www.snopes.com/fact-check/legal-tender-payment/
  - Bjartr 2y ago
    I specifically said "incurred a ... debt" and "without prior... agreement". As your source says > In short, when a debt has been incurred by one party to another, and the parties have agreed that cash is to be the medium of exchange, then legal tender must be accepted if it is proffered in satisfaction of that debt. You are correct that if cash is not accepted at all, or if payment is to happen ahead of the exchange of goods or services, you are not obligated to accept arbitrary cash. And I never claimed otherwise