Curse Forge Token - Githubissues

FlowArg / FlowUpdater

The free and open source solution to update Minecraft.

https://flowarg.github.io/FlowUpdater

GNU General Public License v3.0

97 stars 19 forks source link

Curse Forge Token #12

Closed jacobtread closed 2 years ago

jacobtread commented 2 years ago

Hey are you sure its a good idea for you to upload your curse forge api token to a public repository.... thats really not something you should be doing with any sort of api tokens and just asking people nicely to change it when forking is something that i don't think will work out for you it might be better for you to just have it in some sort of configuration along with a guide for users to help them create a token?

wowkster commented 2 years ago

I agree, you should never expose API tokens in a public repository for really any reason

FlowArg commented 2 years ago

I totally agree with you in the fact that distributing a "private" API Key isn't good. However, I don't have so much choices...

To understand my point, you need to know these two points:

The API Key isn't given to anyone. You can read the CurseForge Article about the 3rd Party API...
Before making the commit, I've asked on the CurseForge Dev Discord server and an admin told me this: . So I simply followed his instructions. If you have better ideas, I'll gladly take them!! Make sure that it is allowed by the Terms of Service of course!

jacobtread commented 2 years ago

I understand where you're coming from with this however rather than giving out complete control to this key that as you've stated has to be applied for instead you could create an api or service of such which abstracts the api aswell as your token away and with said api you could have dedicated routes for only the specific things that your code needs to do

FlowArg commented 2 years ago

It's an idea but how to deploy it? I see atm one possibility : I need to find a server (and pay for it) to host an API. But the thing is everyone depend of this service. If the server shuts down for any reason, all the applications using FU will be down...

I hope there is more possibilities...

jacobtread commented 2 years ago

Yeah that could be an issue im not too sure what to do about that you might be out of other options in that regard ill be closing this issue now that I've shared as much as I can