search

amanharwara / chartr

A web-app to create custom music charts/collages.
https://chartr.vercel.app/
GNU General Public License v3.0
5 stars 1 forks source link

Exposed Lastfm API key #19

Open camdendotlol opened 2 years ago

camdendotlol commented 2 years ago

Describe the bug

When Last.fm is selected as the search provider, the browser sends queries directly to Last.fm with Chartr's API key.

Expected behavior

The Last.fm requests should be routed through your own server to hide the API key. I see you're using a Heroku app for CORS proxying, so it would be a relatively minor bandwidth commitment to make it handle Last.fm requests too. This would also allow you to implement a caching system to reduce the chances of hitting Last.fm's request limit (4 per second, if I remember correctly).

Other

You are likely to see a big increase in traffic soon, if you haven't already. Topsters 2 appears to be on the verge of shutting down. I run the other major open-source topster site, https://github.com/camdendotlol/topstersorg, and the past few days have brought 2-3000 hits/day. My backend is closed-source for now, but I'd be happy to share snippets from my load balancing, caching, and proxying routes if it helps.

amanharwara commented 2 years ago

Hi, sorry for the super late reply... I've only recently gotten back to working on Chartr. Would definitely like to chat about the backend stuff. What is the best way to do that? Email, Discord, something else?

camdendotlol commented 2 years ago

No worries, I've been busy too. Would you prefer Discord or WhatsApp?

amanharwara commented 2 years ago

Discord would work better: Amann )))#6956

camdendotlol commented 2 years ago

Added, my Discord nickname is cyclosa