Skip to content
This repository was archived by the owner on Nov 14, 2025. It is now read-only.
Open
Changes from 1 commit
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions routes/api/meetup.js
Original file line number Diff line number Diff line change
Expand Up @@ -7,10 +7,10 @@ var request = require('request');

exports.meetups = function (req, res) {
'use strict';
var url = 'http://api.meetup.com/2/events?status=upcoming&order=time&limited_events=False&group_urlname=node-dc&desc=false&member_id=26710252&offset=0&format=json&page=20&fields=&sig_id=26710252&sig=f9a8c7e4076e5ed5825f06378a855415af3722a9';
var url = 'https://api.meetup.com/2/events?offset=0&format=json&limited_events=False&group_urlname=node-dc&photo-host=public&page=20&fields=&order=time&desc=false&status=upcoming&sig_id=26710252&sig=dc51b92626c66cdedabf20d5c39aceb4720eb70a';
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Are these sig parameters secrets?

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@adunkman I am not really sure... might be, but that is the test URL they give me. I will do some more research and see what's actually secrete if anything.

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

secrete… gross. :)

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is what a signed API url is:

Similar to OAuth signing, this method of authentication certifies that a request was approved by a particular user. Unlike OAuth-signed requests, key-signed requests may be reused and recycled as long as their corresponding API key is valid. If a signed URL is released to the public, any application can use it to interact with Meetup as if it had that API key; the difference is that it can not change definitive parameters or use the signature against other API methods.

We can use an API key as well, so maybe we should move it to an environment variable. Thoughts?

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah, we should probably move to using our API key from an environmental variable, since somebody could hammer that URL and cause our API key to be throttled/banned.

But, that sounds like a lovely problem for Future Josh and Future Andrew. Created #29.

request.get(url, function (error, response, body) {
if (!error && response.statusCode == 200) {
res.json(JSON.parse(body));
}
});
};
};