6 ms·
This doesn't mean killing JSONP dead, it just means that you'll need a server-side script to generate oauth-authenticated URLs first. This is what I do in one
by mootothemax 14y ago
This doesn't mean killing JSONP dead, it just means that you'll need a server-side script to generate oauth-authenticated URLs first.
This is what I do in one application right now, and it works really well, meaning that for the calls in question, the rate limit applies to the user's IP and not our server's.
- dansingerman 14y agoI've thought about that sort of approach. Can you describe in a bit more detail how you do that, especially how you ensure it is secure?
- przemoc 14y agoIt's not a strict answer, and I'm not the one being asked, but about doing "that" while having at least JSON alone, you can proxy the queries and wrap answers by yourself. E.g. in nginx you can use HttpEchoModule: http://wiki.nginx.org/HttpEchoModule http://wiki.nginx.org/HttpEchoModule http://www.gabrielweinberg.com/blog/2011/07/nginx-json-hacks.html http://www.gabrielweinberg.com/blog/2011/07/nginx-json-hacks...
- NelsonMinar 14y agoI've considered doing this as well. I currently have a Twitter app that's 100% browser Javascript and it works great, but only with unsigned requests. I hate to add any server component but a tiny server that just generates OAuth signatures would work. Then let the user's browser make the requests to api.twitter.com directly, saving me bandwidth. Orthogonal to the OAuth issue, I wouldn't mind if they replaced JSONP with a JSON response with appropriate CORS headers. JSONP is badness.
- Tichy 14y agoWouldn't those URLs be easy to steal, though?
- TazeTSchnitzel 14y agoRequire a cookie (browser will hopefully not send that from other sites), check referer, use HTTPS. It's not going to completely stop someone stealing your bandwidth, but it's better than nothing.