3 ms·
Still, it means that someone else can copy your API key and abuse the API on your behalf.
by delinka 13y ago
Still, it means that someone else can copy your API key and abuse the API on your behalf.
- y0ghur7_xxx 13y agoI don't think so. Stack Exchange checks the referer header.
- delinka 13y agoWhich can also be spoofed.
- mwsherman 13y agoFwiw, the author of the API is a co-worker and I checked with him first, he says it’s all fine. Or put another way, if it’s not fine I’ll hear about it. :)
- y0ghur7_xxx 13y agoThis is a client JS API key. If you want to spoof the referer you have to hack into all users of the web page and change the referer header their browser sends. And for what? Makes no sense.