Hacker News Reader

Comment by dalbotex | Hacker News Reader

Don't CORS restrictions basically render this whole tool useless?

It seems the user created this because they thought that Postman required too many resources as an Electron app.

I'm not sure why they didn't just use a commandline tool (e.g. httpie [1]) that would work with any API, rather than just those with permissive CORS headers.

[1]: https://httpie.org/

So Postman used to be a lightweight Chrome plugin. Then its developers turned it into an electron app with lots and lots and lots of features. They did this as a vehicle to begin offering paid features and enterprise plans.

To your second point, despite years of writing Curl some times its nice to have an interface and for some people that is their personal preference.

Another reason why they moved to Electron may be that Google announced [0] in 2016 that they will discontinue Chrome Apps (outside of Chrome OS).

[0]: https://blog.chromium.org/2016/08/from-chrome-apps-to-web.ht...

I suppose it's useful for APIs with permissive CORS headers. Maybe there's also some way to run it locally as a separate app with SOP disabled?

Maybe something like:

  $ chromium-browser --disable-web-security --user-data-dir="/tmp" --kiosk https://liyasthomas.github.io/postwoman/

Unrelated, meta note: why does indiehackers need a separate interstitial splash screen, visible for ~4-5 seconds to load a simple article page?

Then you're launching a second chromium instance and practically recreating Electron.

Yes, indeed. Sort of defeats the point of Postwoman being more performant..

Still, this seems safer than the various extensions that have been recommended in order to disable the SOP. I'd rather the user's data wasn't on the line.

Right, so I don't see any reason why I would ever want to use this tool when far superior alternatives (like postman) exist.

load balancer /s

I use Postman a fair bit, and looking through my history it's mostly playing with 3rd party APIs to see what format they return and how they respond to query params and such. So it works for that purpose, since those generally won't have CORS restrictions.

It probably won't work for testing of your own API endpoints for, say, a SPA, though, which is likely to have CORS. But for local testing where I control the backend, I mostly just rely on printing responses to the terminal anyway.

It indeed seems to be totally broken.

it could proxy the requests through a server.

I don't understand. Plus it has 1700 stars on github.

What exactly is there to "understand"?

~~Does Postman work with JS? I've used it with Python.~~

Oh nvm I'm thinking of a different service

Reply on news.ycombinator.com