5 ms·
very nice! might want to remove api_key from source though :)
by cnlwsu 13y ago
very nice! might want to remove api_key from source though :)
- mwsherman 13y agoThanks! The key is not private, it‘s simply a ‘favor’ to the API to identify where the requests are coming from. The app gets a higher rate limit in exchange for registering.
- delinka 13y agoStill, it means that someone else can copy your API key and abuse the API on your behalf.
- y0ghur7_xxx 13y agoI don't think so. Stack Exchange checks the referer header.
- delinka 13y agoWhich can also be spoofed.
- mwsherman 13y agoFwiw, the author of the API is a co-worker and I checked with him first, he says it’s all fine. Or put another way, if it’s not fine I’ll hear about it. :)
- y0ghur7_xxx 13y agoThis is a client JS API key. If you want to spoof the referer you have to hack into all users of the web page and change the referer header their browser sends. And for what? Makes no sense.