Why I avoid SDKs in production

Re:Why I avoid SDKs in production by nl on Tuesday February 04, 2014 @03:58PM (#7180215)

I wrote a thing to start & stop OpenStack servers via JavaScript. HTTPS is a thing.

I have trouble thinking of any API that shouldn't be callable from a client.

[ Parent | on HN ]

Re:Why I avoid SDKs in production by kodablah on Tuesday February 04, 2014 @04:08PM (#7180268)

Any API that uses some form of authentication token that is not obtained via some user-based interaction like OAuth may need to be at least proxied via a server side piece to prevent exposing credentials/keys.

[ Parent | on HN ]

Re:Why I avoid SDKs in production by nl on Wednesday February 05, 2014 @05:50AM (#7183010)

Err.. why?

Clearly the keys need to be obtained somehow, but that was out of band for my application. Once they are obtained I don't see any reason why passing them from a 3rd party app over HTTPS (using CORS) is any less secure than using session based authentication with a 1st party app.

In both cases you are vulnerable to MTM and XSS attacks. Sessions expire which is nice, but that's the only real difference.

[ Parent | on HN ]