Are you able to elaborate further on what attack vector you're thinking of (if only so I can google it) - JSON hijacking maybe?
The implicit assumption being that internally everything trusts the proxy?
The implicit assumption being that internally everything trusts the proxy?
Proxying requests to a third-party will mean browser security features like CORS will assume they are entirely safe due to them appearing to come from your domain, and not “gist.github.com” etc.