Hacker News Reader

Comment by mootothemax | Hacker News Reader

This doesn't mean killing JSONP dead, it just means that you'll need a server-side script to generate oauth-authenticated URLs first.

This is what I do in one application right now, and it works really well, meaning that for the calls in question, the rate limit applies to the user's IP and not our server's.

View on HN

I've considered doing this as well. I currently have a Twitter app that's 100% browser Javascript and it works great, but only with unsigned requests. I hate to add any server component but a tiny server that just generates OAuth signatures would work. Then let the user's browser make the requests to api.twitter.com directly, saving me bandwidth.

Orthogonal to the OAuth issue, I wouldn't mind if they replaced JSONP with a JSON response with appropriate CORS headers. JSONP is badness.

I've thought about that sort of approach. Can you describe in a bit more detail how you do that, especially how you ensure it is secure?

It's not a strict answer, and I'm not the one being asked, but about doing "that" while having at least JSON alone, you can proxy the queries and wrap answers by yourself. E.g. in nginx you can use HttpEchoModule:

http://wiki.nginx.org/HttpEchoModule

http://www.gabrielweinberg.com/blog/2011/07/nginx-json-hacks...

Wouldn't those URLs be easy to steal, though?

Require a cookie (browser will hopefully not send that from other sites), check referer, use HTTPS. It's not going to completely stop someone stealing your bandwidth, but it's better than nothing.

Reply on news.ycombinator.com