Hacker News Reader

They are sending a lot of info in that GET request:

http://ak-media.soundcloud.com/xpO4gBZA21w4.128.mp3?AWSAcces...

128 bitrate? Amazon access key Expires ?? No idea what gda is. Also their signature.

This is security 101 right? Or is this normal for a service of this kind? Also are they officially using the Soundcloud API? if yes, is this one of the responses of the API?

View on HN

not sure on the security implications, but this could have easily been masked through some backend call.

what suggestions do you have on masking the url, would love to hear your input.

Proxy it through a URL on your box i.e. make http://myserver.com/song_id point through to http://soundcloud.com/song_id?secret=params

Solving what?

Only way to really hide the info would be to really stream all content through their box. Then they just could host it themselves in the first place...

This hides your API key from other people.

exactly

Couldn't you essentially call a handler on the Console.fm server which has the key already coded and it makes the request to SoundCloud?

This would avoid the fact that users could see the GET request to the SoundCloud API.

Reply on news.ycombinator.com