Hacker News Reader

Thank you for the suggestion. I'm not so familiar with this. Will this work on frontend too? If I expose the secrets on the fronted, then it's pointless. Do you have some suggestions on how to do this? Appreciate the help! It's an important aspect and a very resource intensive process that I need to protect.

View on HN

To the extent that you are pulling new stories directly from Firebase on the client side, encrypting (or signing) urls with a symmetric key will not work. This is because you would need to embed the secret in the front-end code which means the secret is no longer secret ;-)

You could also tail the Firebase feed from a server process, generate the relevant images and only serve images for pre-existing urls.

Your decryption/encryption secret (key) is stored on the server side only and if a client requests a thumbnail, you can validate the URL value by successfully decrypting it with this secret and probably do a simple HTTP URL validation check of the decrypted value. And you have to encrypt all thumbnail URLs with this secret before passing them to the client.

Reply on news.ycombinator.com