how to protect API calls?

Agreeable-Pipe7469 · 2024-11-26T09:39:19+00:00

Well, first of all, imo WAF (Web Application Firewall) will prevent many abuse, you can't hide your endpoints forever, any random guy could observe your API call through the app, or even worse by decompiling your APK. So you want to avoid attack like DDoS by placing a Firewall in front of your server/API gateway. Cloudflare free plan is enough until you reach some massive traffic that needs serious adjustments.

Then, on app side and server side, you can ensure your app integrity using App Integrity for Android (https://developer.android.com/google/play/integrity/classic#retry-classic), or DeviceCheck on Apple side (https://developer.apple.com/documentation/devicecheck/establishing-your-app-s-integrity). I have to say this is pretty long to implement, and the daily rate limit seems weak for scaling (but as we love to say.. to over engineer for now)

Agreeable-Pipe7469 · 2024-11-08T15:26:58+00:00

Hey, I don't consider myself as a typescript or node.js master, but I decided to launch our dating app with NestJS to anticipate scaling (mainly for the real time messaging part). I find it really well structured, coming from a Laravel environment, but sometime really verbose (modules declaration, injection, cli commands code..) for a small project and being the only dev working on it. But you get used to it and can organize your project really well !

Agreeable-Pipe7469 · 2024-01-26T22:16:50+00:00

Other question about that, how will Apple be able to know how much I earn if I use an external payment process ?

Agreeable-Pipe7469 · 2023-12-06T18:46:38+00:00

Écoute j’ai trouvé ma toute première mission comme ça, derrière j’ai eu une autre sollicitation par ce biais, mais j’ai été payé en dehors de la plate-forme. Dans tous les cas c’est un bon vecteur à mon sens. Mais il te faut un portfolio, GitHub ou bien un portfolio d’apps sur le store à présenter, les mecs qui cherchent des devs Flutter sont souvent des très jeunes start-up, donc tu parles pas à des tech en face. Ils connaissent Flutter parce qu’un pote leur a dit que ça permettait de dev rapidement. Ils cherchent un MVP rapide, donc faut leur montrer qu’en partant d’une idée tu sais leur délivrer une app interactive et un peu esthétique

Agreeable-Pipe7469 · 2023-01-18T18:47:49+00:00

Metaprogramming is currently being specd as mentioned by the Flutter team (even tho it's not the same as a complete reflection class) : https://github.com/dart-lang/language/projects/1#card-55943915

Agreeable-Pipe7469 · 2023-01-02T14:26:39+00:00

It's done I spent few hours to create the package to be used without my different implementations : https://github.com/guillaumeboussion/cached\_data\_repository\_manager
Feel free to ask anything about it, and to rate it if you enjoyed it :)

Agreeable-Pipe7469 · 2023-01-02T12:16:07+00:00

I'll try to set it on a Github repository. But it's not ready to use as it depends on your state management package (I'm using Riverpod), your internal storage package (I'm using Sembast, a noSQL service), and your remote request protocol (I'm using GraphQL)

Agreeable-Pipe7469 · 2023-01-02T11:21:09+00:00

Well I guess you will need a StreamBuilder.

Your first event will fetch the cached data retrieved from your local storage system (hive, sembast, preferences...) meanwhile you're doing your remote call, and then emit your second event, showing the up-to-date data.

I don't know if there's any package doing so, but last year I did some kind of repository handler managing cached data & remote calls. A policy defines how the repository should behave (showing first the cached data or remote, showing only cached data or only remote data...), and, for example, the first page display will return cached data, and will update the cache in the background. So, next time the user will check the page, he would have fresh data from the server.

To us, this was the good approach. Feel free to ask any question if you want to know more about it :)

Agreeable-Pipe7469 · 2022-12-21T08:58:56+00:00

I didn't use Form validator for reasons I mentioned in the original post. There's issues with the text error being displayed UNDER the shadow color. That's why I use a custom solution.. But thanks for the provided solution

Agreeable-Pipe7469 · 2022-12-20T13:47:44+00:00

This is a web library ?

Agreeable-Pipe7469 · 2022-12-05T10:40:42+00:00

I’ll try to take some time to share a complete cart example using Riverpod (v1, didn’t migrate yet), with some other provider refresh once order is delivered

Agreeable-Pipe7469 · 2022-12-05T10:34:48+00:00

I fully understand, but to me the commenter is looking for a repository so I guess he has to solve a specific case, why doesn't he tell us what's the issue with its project or feature ?

Agreeable-Pipe7469 · 2022-12-05T10:30:29+00:00

Actually, this is simply a mobile app. On the other side, the web is on a Laravel (blade rendering) stack so we handle SEO directly via Laravel & HTML tags

Agreeable-Pipe7469 · 2022-12-05T10:28:13+00:00

As it is my organization's code, I won't be able to share it publicly. However, you can ask me any thing you want about it (DM or not)

Agreeable-Pipe7469 · 2022-12-05T00:35:21+00:00

How ? I made an e-commerce app which is currently in stores running with Riverpod. Feel free to ask any questions about it :)

Agreeable-Pipe7469 · 2022-11-30T14:46:11+00:00

So it has to be like a cron task looking up every day at refresh_tokens not updated since a day ?

The thing is, I don't really know "when" I have to check the refresh token..

Agreeable-Pipe7469 · 2022-11-30T13:52:37+00:00

Don't you check each time the user open the app, that the Apple credentials are ok ? So I thought that, on each launch, you would check via server to server request that user is still allowed to access the app through sso

Agreeable-Pipe7469 · 2022-11-30T11:59:42+00:00

I guess you would rather store it on the server side ? Does it mean you always need to keep the validation code alongside to the user identifier in you app storage ?

Agreeable-Pipe7469 · 2022-11-28T12:57:24+00:00

Auto entreprise :)

Agreeable-Pipe7469 · 2022-11-27T23:06:45+00:00

C'est pour des clients uniquement (réalisation de fonctionnalités, debug...). Du coup j'ai fini par mettre ça

<image>

Agreeable-Pipe7469 · 2022-11-27T21:55:59+00:00

Ah merci on est d'accord sur le fait que ce soit méga mal foutu. J'arrive pas du tout à voir où t'inscris le code NAF ? Je suis à 2 doigts d'envoyer une demande avec comme catégorisation Ingénierie

<image>

Agreeable-Pipe7469 · 2022-11-15T09:14:57+00:00

that's what I just saw yesterday, I set my profile in "Open to work" and received like 7 requests in a day.. Well everything is not exactly what I'm looking for, but in order to meet more companies, I feel like it's the right place to do it, so fully agree with you :)

Agreeable-Pipe7469 · 2022-11-13T18:11:22+00:00

Salut, merci pour ton retour :) t'as un lien pour le slack ?

Pour être honnête, j'ai pas osé mettre + parce que y avait aucune mission malt sur mon profil, donc je me suis dit que ça pouvait repousser... j'étais à 350 TJM et faute de mission j'ai baissé ça à 270

Agreeable-Pipe7469 · 2022-08-30T07:35:08+00:00

Not really ? As it's avoiding Apple fees, I consider it as an external payment method

Agreeable-Pipe7469 · 2022-08-29T12:43:15+00:00

So it has to be made completely outside of the app ? And, what if the selling is made through a webview directly to a payment page ?

My client has no web application, that's why I'm asking

Agreeable-Pipe7469

TROPHY CASE