Feature request: Hide API keys from API calls about homepage HOT 7 CLOSED

Hey, thanks for checking out my project :)

I agree, this is something that really would be needed for any use case outside of an internal network. I have a few ideas on what could be done but you're right, it would take a bit of reworking.

It might be valid that all requests ultimately end up passing through the backend proxy.

from homepage.

Alright.... This was a big one.

I've fully refactored the entire widget system to pass all API calls through the backend, using mostly reusable API handlers, along with a few specific ones for the special cases. No secrets are ever sent to the frontend now, and everything is handled in the services widget proxy endpoint.

I've locally tested every widget, so I'm quite sure everything should still function in the exact same way with no changes on your side.

from homepage.

Nope, it should all be proxied now. Just waiting a bit for some other users to test it out to confirm everything is good.

from homepage.

I kept the API requests on the frontend purely for performance, and since I personally intended to run this privately, any proxy functionality that currently exists is to bypass CORS restrictions only.

from homepage.

Great work @benphelps, let me try it out on my setup :).

Is there anything else we need to implement to close the ticket?

from homepage.

Looking good! I have tested my services and they are working nicely so far (except for Openweathermap, it's still leaking).

I'll close this ticket as implemented!

from homepage.

This issue has been automatically locked since there has not been any recent activity after it was closed. Please open a new discussion for related concerns.

from homepage.