search

NodeBB-Community / nodebb-plugin-iframely

Iframely Embeds for NodeBB
MIT License
17 stars 13 forks source link

Can we add forum's domain name to API calls? #6

Closed iparamonau closed 9 years ago

iparamonau commented 9 years ago

We would love to see it as &origin=domain.name query string param.

iparamonau commented 9 years ago

or better yet &origin=nodebb-domain.name, with nodebb hardcoded prefix. This way we would be able to attribute API keys to this plugin

julianlam commented 9 years ago

@iparamonau Sure, that can be done, though we'd be retrieving the value from the server configuration, so you may get a lot of &origin=localhost:4567 as users may be testing/installing it on their local machines, or forget to change the base_url. :laughing:

iparamonau commented 9 years ago

Yeah, it's fine. The side reason for the origin is that if we publish plugin with an open endpoint fallback, then there better be a way for us to block some domains if need be.

julianlam commented 9 years ago

Assuming you'd block origins without ?=origin=nodebb- prefix?

iparamonau commented 9 years ago

Our mechanisms can go after specific origins like nodebb-iframely.com that are linking to open endpoints.