Hacker News Reader

Pretty cool, but there should be a warning not to enter in API credentials (through the URI) on this page, as the request is proxied to jsonbrowse.com

View on HN

That's fair. CORS is a bitch.

YEs, CORS is the reason for this and the code for this proxy is open source and very simple[0]. I didn't want to add disclaimers to clutter the UI nor did I wanted to build a browser extension as it would suffer from same trust issues (you still need to trust the extension developer).

For full transparency, the proxy is hosted on Zeit's `now` service and I don't even have access to logs so accidental leaks should be pretty safe.

[0] https://github.com/jorilallo/jsonbrowse-proxy

By the looks of it, I could just throw at it some response that is massive and it would still attempt to grab it?

If this is really being just run as a proxy setup, the jsonbrowse-proxy might not need the isomorphic-fetch lib, in which case you can just use the embedded node-fetch instead, which has max response size and timeout options available.

Reply on news.ycombinator.com