Hacker News Reader

You need to tell Mailer.js about your API key

What exactly stops me from stealing someone else's API key and using it to send spam? You can't trust the client.

That was my first thought, however, from the docs:

MailerJS will send mail to the address you enter on your account page. You can't specify the receiver dynamically, as client-side JavaScript is publicly accessible by definition, and we want to protect you from spammers.

Why steal someone's api key just so you can send them email?

(not something I would do, but someone else would) To put them over their account limit.

You need to input the domains you'll be running Mailer.js on[1], so perhaps API keys only work on those domains? This is just from preliminary reading, so I could be wrong. :)

[1] https://www.mailerjs.com/documentation

If you're trying to protect from hacking via HTTP Referrer info, you're doing it wrong.

Anyone can fake HTTP Referer info, and if they're going to the trouble of stealing an API key then they're not just a passing bot.

Reply on news.ycombinator.com