News for hackers. Stuff that matters.

A comment on Fidor Bank API. Parent comment

Re:Fidor Bank API by kyledrake on Friday March 13, 2015 @07:14PM (#9200698)
These libraries are screen scrapers with no security control. You can't make a read only version that prevents an attacker from using your API key to steal your money, for example.

I want to completely disclose Neocities financing, and lack of API for safely doing this has been a frustrating problem.

[ Parent | on HN ]
Re:Fidor Bank API by zaroth on Saturday March 14, 2015 @03:03AM (#9201790)
You would have to proxy the requests on your server, enforce read-only on your public facing API, and keep the token sever-side for talking to the bank?

Put varnish in front of your API to act as a caching layer and prevent anyone from causing your server to overload the bank API.

[ Parent | on HN ]