The modern HTTPS world has no place for old web servers

Re:The modern HTTPS world has no place for old web servers by Wowfunhappy on Wednesday May 13, 2020 @06:49PM (#23172768)

You can use a proxy, yes. The workaround I suggested to users on OS X 10.4 – 10.8 was to set up a web server with the following PHP file:

    <?
    header('Access-Control-Allow-Origin: *');
    $url = $_GET['url'];
    echo file_get_contents($url);

And then edit the dashboard widget's API request url to point to:

    http://theWebServer.com/thePhpFile.php?url=https://darkSkyURL

But, this required users to have access to a web server.

I very briefly considered setting up a public instance, but I'm not a professional web developer and didn't know what the implications would be, either for the overall security of my server, or in bandwidth costs, particularly if malicious users started using the "proxy" for other things. All of the client-side code is out in the open, so it also wasn't clear how I'd make an authentication scheme. I'm sure there's a way, but again, not a web developer!

[ Parent | on HN ]

Re:The modern HTTPS world has no place for old web servers by laughinghan on Wednesday May 13, 2020 @10:31PM (#23174583)

I think the suggestion is to skip a web server at all and go "serverless" with Cloudflare Workers, which are free for up to 100,000 requests/day: https://workers.cloudflare.com/

If your Worker code hardcodes the Dark Sky domain, the worst an attacker could do is either use up your free worker quota from Cloudflare, or hammer Dark Sky at the Worker ratelimit (1,000/minute, which Dark Sky should easily handle).

AWS, Azure, GCP all also have free tiers for their serverless services. RunKit (http://runkit.com) might also work.

These are all likely to be HTTPS-only, but hopefully at least one of them supports TLS v1.1, rather than being 1.2-only like apparently is the problem with Dark Sky.

[ Parent | on HN ]

Re:The modern HTTPS world has no place for old web servers by divbzero on Thursday May 14, 2020 @02:14AM (#23176002)

Serverless would work but my initial idea was more basic, simply a combination of something like:

A. DNS record (foo.example.com CNAME api.darksky.net)

B. TLS forward proxy (e.g. Cloudflare Full SSL https://www.cloudflare.com/ssl/)

C. Host header rewrite (e.g. Cloudflare Page Rules https://support.cloudflare.com/hc/en-us/articles/206652947-U...)

[ Parent | on HN ]