search

bauripalash / fossurl

Your Own Url Shortner Without any fancy server side processing and support for custom url , which can even be hosted on GitHub Pages
MIT License
138 stars 44 forks source link

JSONstore allows anyone to just purge the list using DELETE requests. #2

Closed p410n3 closed 6 years ago

p410n3 commented 6 years ago

Do a backup before somebody deletes it!

bauripalash commented 6 years ago

I encourage people to host it themselves and use their own jsonstore endpoint.

p410n3 commented 6 years ago

Which still allows everyone to just read the URL out of the index.js and mess with the JSON however he wants. JSONstore is not secure to use that way. At least proxy the request using PHP / node / perl or a damn bash script. The JSONstore URL is basically a secret. Dont expose it.

You can rely on another service or make your own if you realy wanna keep it Client side only, but security wise its just not good right now.

bauripalash commented 6 years ago

@p410n3 Any Suggestions of another service ??

p410n3 commented 6 years ago

now.sh or heroku

bauripalash commented 6 years ago

i tried now.sh but i can't install their cli as i have 32bit ubuntu linux. and in heroku , a plan has to be bought unless wait for 10 seconds

p410n3 commented 5 years ago

I still believe you should try to find a Database that can not be deleted by literally everyone. Something that only allows you to add new data is fine.

Not being able to see other ppls data is a plus, but just being able to delete the whole thing in one second kinda sucks dont you think?

bauripalash commented 5 years ago

@p410n3 I'm planning to rewrite the whole thing in NodeJS and with MySQL Database, as soon as my school exam ends and also the Google Code-in (In which I'm Participating)