Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Future proofing #679

Open
FrostKiwi opened this issue Nov 29, 2024 · 0 comments
Open

Future proofing #679

FrostKiwi opened this issue Nov 29, 2024 · 0 comments

Comments

@FrostKiwi
Copy link

Right now the utterances API is hosted on Azure and client.js is hosted utteranc.es. So far, this project has been rock solid. Should the utteranc.es domain expire and a bad actor grabs hold of it, then many blogs will be subject to a painful attack, where client.js can be replaced with anything.

So I want to make sure, does this project require help or funding, to secure utteranc.es's future? Or is it fine for the next decade?

Ideally, there should be a way to host client.js by oneself and still allow the interconnect to the utteranc.es API. Practically, this is not possible, due to how CSRF and authentication interact. So if there is a way to allow the static client.js to be hosted by oneself, without the self-hosting of the API, then I think this project should pursue it.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant