Fabian Iwand

It’s good you’re checking location.pathname 👍 but I’d also suggest validating the event.origin in your onMessage listener here so that it only listens to messages from the intended notebook origin, e.g., https://mootari.static.observableusercontent.com. That could either be hard-coded for you (safest), or perhaps you could infer it from the location at the time the bridge is instantiated. Otherwise, you’re reliant on that timeout loop to destroy your bridge, and possibly you’re open to a window.opener attack.

Note: this reply does not constitute endorsement. I’m not going to weigh in on that at this time. I’m very much in favor of us developing a public API at some point, but we have to prioritize that against all the other things we need to build.

Mike Bostock

@mbostock Sorry for the late reply! You're absolutely right, checking event.origin is a must when working with the Message API.
This notebook is currently receiving a complete overhaul, so it might still take a while until this change makes it into the published version.

I am violating Observable's Terms of Use?

Tom Larkworthy

as in "may violate", wrt "Acceptable Use" > "Conduct restrictions": "[...] attempt to disrupt or tamper with Observable’s servers in ways that could harm our Website or Service, to place undue burden on Observable’s servers through automated means"

Also potentially the section about Scraping

Even with Cloudflare as frontend, authenticated requests still get passed through uncached. One time I accidentally hit Cloudflare's rate limit, hence the importance of a proper rate limiter in the proxy code.

OK cool, and arguably to uphold "You are responsible for keeping your account secure while you use our Service." you need to audit this software and ensure your access_tokens are not leaking.

Good point as well! Yeah, I'm basically covering my ass to reduce the chances that this notebook gets taken down because it might "encourage abuse". Perhaps I should call it an "academic example"! ^^

Purpose-built for displays of data