Comments (8)
If anyone has any corrections, additional information, or suggestions, please comment here. I've been communicating with Troy Hunt of haveibeenpwned.com in an attempt to determine a way forward, but I've gotten nowhere.
from hibp.
Any more updates on this?
I think we're just going to have to move away from the library all together as it seems absolutely fine if I use Fetch/Axios with a custom UA.
from hibp.
Can you provide more details around exactly what you're doing that works? Are you running in Node.js or a browser?
I can add an option to allow setting your own UA, but that is only temporarily side-stepping the problem (you may get blocked again, requiring you to change the UA, which is actually against Troy's acceptable use policy) and would only currently work in Node.js environments (as stated multiple times).
from hibp.
I wish I could provide more information other than the fact all I'm doing is setting a custom UA. The UA is specific to our product and Troy is aware as we've been in contact with him before regarding this issue and before we integrated it into our platform. If we set the UA, it works, if we don't or use the default in your library, it doesn't work.
I think the option to add your own UA is a useful feature as it's explained on his website that the UA should describe the service using it.
I wish I could on the browser side of things but I have no ideas other than discussing that with Troy?
from hibp.
OK, so you're in Node.js. Which version of hibp
are you using? Have you tried that same version from a different network/location? I suspect the blocks are a combination of UA and IP as the same version of hibp
(i.e. same UA) works for some people but not everyone (the difference being which Cloudflare region they hit).
As for the browser, what do we do? As I see it, there are only 2 options: Troy relaxes the new rules to allow browser UA's again, or we drop browser support from the library - which would be a bummer. 🙁
from hibp.
I just emailed Troy one more time in hopes of getting an answer with regards to the browser. We need to establish if browser UAs are intentionally and permanently blocked for the breachedaccount
endpoint (meaning we drop browser support from hibp
) or if he just has something misconfigured/overly strict. 🤞
from hibp.
Troy responded and confirmed browser UAs are intentionally blocked. This policy seems to be currently applied the breachedaccount
endpoint only. He has not clarified (yet) if the other endpoints will start blocking browser UAs or not.
For the time being, I suppose I will update If it turns out all the endpoints adopt this same policy, I will probably remove browser support from hibp
to throw an error if you attempt to call the breachedAccount
function from within a browser and document that the upstream API has denied that particular action.hibp
entirely.
@kierxn If you can tell me which version of hibp
you're using that gets blocked and confirm that you've tried that same version from multiple networks/locations and still got blocked, that would be quite helpful.
I'm tempted to just expose the Axios instance itself (or similar), so you can customize it however you wish (custom UA, proxy requests through your own server somewhere to get around the browser block, etc.) but that really locks us into that particular implementation detail. Meh. Edit: I'll just expose UA and baseUrl (for proxying) configuration options and leave it at that.
from hibp.
I've exposed some additional options to help alleviate these problems (released in [email protected]
). Closing the issue for now as there is probably nothing else we can do at the library level at this time. Feel free to comment if any new information becomes available.
from hibp.
Related Issues (20)
- Add API key support for paid endpoints (namely, `breachedaccount` and `pasteaccount`) HOT 1
- Update documentation for API v3 HOT 1
- Action Required: Fix Renovate Configuration
- CORS Error HOT 1
- Refactor pwnedPasswordRange to resolve with object? HOT 2
- Refactor pwnedPassword.js to use hash range API HOT 3
- All Contributors HOT 14
- Change pwnedPasswordRange to resolve with array of objects HOT 4
- Dependency Dashboard
- LogoType HOT 1
- Is there timeout on fetch? HOT 2
- Rate limiting `retry-after` HOT 2
- Error - "You may need an appropriate loader to handle this file type" HOT 5
- Not finding realy simple passwords HOT 3
- Forbidden - no user agent has been specified in the request. HOT 17
- Cannot use hibp modules in React Native development mode HOT 3
- Update rate limit handling HOT 1
- Invert `includeUnverified` option on `breachedaccount` endpoint HOT 1
- Invert `truncateResponse` option on `breachedaccount` endpoint HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from hibp.