Hacker News Reader

Comment by vonadz | Hacker News Reader

Thanks! I'd like to explore adding debugging and warning alerts in the future. Right now it's kind of hard to tell if anything is broken, short of going through the registration process myself. If you're pulling javascript hosted somewhere else to your site, doesn't that expose your slack API key?

View on HN

I should have explained more. The javascript is dynamically created and hosted on S3. The keys, etc are safely on a server that runs to generate the file. I built this around the time Cloudflare first released workers, their documentation seems much less confusing now.

I'm having a hard time understanding how a file hosted on S3 can send a request to Slack without exposing your API key. Can you elaborate on that?

EDIT: guessing by the delay in response, someone just told all of HN they exposed their API key?

My understanding is that they used cloud functions. Code is being executed on someone else's server, not the client, so the keys don't have to be shared with the client.

That would be the logical solution, but "The javascript is dynamically created and hosted on S3. The keys, etc are safely on a server that runs to generate the file" sounds a lot like they have a server where they build a .js file that is capable of querying Slack, then store that file on S3 for the website to pull whenever someone registers. In that case, the client is pulling a .js file that probably has the Slack API key in it.

Reply on news.ycombinator.com