Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Claude's API now supports CORS requests, enabling client-side applications

simonwillison.net

Post reply on HN
Print view View original

151–160 of 173 posts

Re: Claude's API now supports CORS requests, enabling client-side applications

#151

Post by thiht »

saagarjha wrote: post #53

Web security noob here. Why does CORS even exist? The fact that a website can’t make a request to another website unless that domain likes it is kind of insane to me. Everyone in the comments here is going on about how maybe the user’s API key gets leaked by a malicious application or whatever but, like, when I write software that isn’t in the browser I can just send a request to anyone without restrictions and as fa…

There are always some mild arguments that CORS is better that nothing, but honestly your intuition is right, CORS is absolute nonsense.

Re: Claude's API now supports CORS requests, enabling client-side applications

#152

Post by mattrighetti »

afiodorov wrote: post #10

I love making web apps where users bring their own keys. This approach combines the best of both worlds: the convenience of distributing executable files and the benefits of open source. So far, I have developed two web apps: 1. A live transcription and translation app that uses microphone input. This is useful for watching proprietary content and facilitating communication. 2. An app that translates SRT subtitles in…

I’ve always thought this would be a cool thing to offer, one thing that I’ve asked myself though is why should I trust you to use my key? Who guarantees that you’re not going to abuse it or use it in an inefficient way?

I’m unfamiliar with how these keys are priced but I guess they still use number of tokens that you input? What happens if one day your software has a bug that sends 1k tokens multiple times and I get charged for it because I’ve used my key?

Note that this is not a complaint and I would definitely love a “bring my key to use for free” tier, just a legitimate question that I asked myself from time to time.

On the other hand, I trust you very much in doing your best work to avoid any bug like the one I’ve presented above and squeeze every little penny out of your key to maximise earnings.

Finally, how do you make people entrust you with their keys?

Re: Claude's API now supports CORS requests, enabling client-side applications

#154

Post by samstave »

meiraleal wrote: post #101
samstave wrote: post #87

Earlier quoted context omitted.

>> why this took them so long They were trying to have Claude code it up - but every time it got close to working, Claude would lose context and hallucinate and the code would break. Been there too many times with Good Ol' Claude.

funny but this proves that claude is now good for code?

Ive been coding with claude pro an app for the past month and While claude is amazing - it loses context pretty darn quick - and its ultra frustrating - look at my post history where I have written about it in some detail.

When I have the energy I should write up a detailed response - but I feel that I have experienced a lot of nefarious with Claude and how it operates.

Re: Claude's API now supports CORS requests, enabling client-side applications

#155

Post by [deleted] »

Jarwain wrote: post #91
samstave wrote: post #86

Earlier quoted context omitted.

I think the biggest issue is that the vast majority of all Internet Users, including 'techies' really dont understand Secretes, Security, risks, non-risks etc... I think that What HN (the site) is actually lacking is any kind of formal education [section] on the state of tech. Esp. given how much of SV tech zeitgeist flows through the frontpage of HN and the folks in its orbit - HN is missing out on a service that co…

Yesyesyesyesyes I didn't realize how badly this is needed and how much I would like to work on this until you brought it up. It's wild how much useful information flows through the HN Zeitgeist! I singlehandedly attribute my career success/position to keeping up with it all

[deleted]

Re: Claude's API now supports CORS requests, enabling client-side applications

#156

Post by pzo »

6510 wrote: post #139
serjester wrote: post #134

Earlier quoted context omitted.

While this is nice, I don't think the dangers are discussed enough. A user has no guarantee their key isn't just being sent to some malicious third party. Normalizing this seems dangerous because it only takes a couple bad actors. Sure you could try to get people to issue / delete keys every time they use an online app but it seems unlikely most users will do that.

The browser doesn't need to facilitate this. They could generate an application specific key. Could do that every time one uses the application by forwarding though the website issuing the key and back. I want government id to work like that. You authorize the website on the .gov then the website only gets a key, no further information. The only thing to knows about the key is that each citizen gets to generate one k…

probably not a good idea for your government to know their each citizen what kind of websites uses. However there are similar idea currently in some crypto projects that trying to solve it to make it distributed, so that if you e.g. like gambling the government won't know about it but website that provide gambling services can still check that you are from non banned countries and adult without any more detailed KYC

Re: Claude's API now supports CORS requests, enabling client-side applications

#157

Post by jameshart »

tsimionescu wrote: post #149
apitman wrote: post #131

Earlier quoted context omitted.

The UX could be so much better and more secure. This type of use case is a perfect fit for OAuth2. Current UX: 1. User hits your app 2. You tell them to go to Anthropic and generate an API key. You'll probably need to give them instructions on how to do so, which will become outdated over time as Anthropic makes changes to their website. 3. User goes to Anthropic and generates an API key 4. User manually navigates ba…

You have to remember that dev time is always at a premium. Even if it takes one week to build OAuth2 support, that's one week delay on other features. It's always a matter of priorities.

Sure but the alternative we are talking about here is encouraging developers to paste their API keys into random web pages.

I don’t think we should accept the argument that since implementing a respectable authorization scheme might take a bit of effort, it’s okay for sites to ask users to just hand over their password.

Re: Claude's API now supports CORS requests, enabling client-side applications

#158

Post by jameshart »

bilater wrote: post #141
afiodorov wrote: post #10

I love making web apps where users bring their own keys. This approach combines the best of both worlds: the convenience of distributing executable files and the benefits of open source. So far, I have developed two web apps: 1. A live transcription and translation app that uses microphone input. This is useful for watching proprietary content and facilitating communication. 2. An app that translates SRT subtitles in…

I love this pattern as well, but as some comments have pointed out, there is a pitfall of security risk (you don't know where your API key is going). I think it would be really cool if more services let you cap API key usage, so it's almost like a virtual credit card number. I could then put in API keys to sites without worrying and knowing that at most, I can lose, say, $10 or something.

This is pretty much exactly what an oauth2 flow is. You generate a single-use-specific token and constrain it with the limited permissions you choose. If a site wants to offer an oauth token flow where users can put a time or credit usage limit on the token they absolutely can do so.

Re: Claude's API now supports CORS requests, enabling client-side applications

#159

Post by pzo »

CuriouslyC wrote: post #88
brookst wrote: post #82

Earlier quoted context omitted.

I don’t think it’s cheap because VC money is subsidizing losses on every token. It’s getting cheaper because models and infrastructure are becoming more efficient. And I really don’t think any of the AI API providers can “capture the whole market”. There are at least 3 of ballpark equal capability, so I don’t see how dramatically raising prices is compatible with dominant market share.

Even if the inference is getting cheaper, all the frontier companies are running massive losses building and serving it. That has to come back eventually, that's just how capitalism works. Just remember that Netflix didn't start really jacking up the price till after the other players entered the streaming war, when they were pioneers it was dirt cheap. The existence of Disney+ didn't stop them at all.

if new models won't require to have significantly better hardware then I think eventually many cases will be run on locally. Currently you have macbook pro with even 128GB RAM - of course almost nobody has it but those hardware will be mainstream common in ~5 years. You already can have ollama - you just need to have equivalent preinstalled by Microsoft/Apple/Google on their all new devices - again most likely this will happen in <5 years.

Re: Claude's API now supports CORS requests, enabling client-side applications

#160

Post by pzo »

TeMPOraL wrote: post #33
bboygravity wrote: post #28

Earlier quoted context omitted.

I do the same now for a firefox extension I wrote (automatic form-filler that works way way better than anything else out there). So it's also "bring your own keys" but then how do you monetize at all? I personally don't like "bring your own keys" at all from a user-friendlyness perspective. It means that you exclude the vast majority of potential users, because they don't know what that even means. Even "create an a…

> So it's also "bring your own keys" but then how do you monetize at all? TypingMind.com is a "bring you own API key" (obviously, being a LLM frontend), that's also successfully monetizing users. The secret is that it's actually a very good product ; until recently, it was far ahead of the official tools (I mean, they had plugins for like half a year before OpenAI started talking about "GPTs"), so paying for the lice…

I think with some good UX that people suggested in different post (such as OAuth etc) it could work even with non tech savy users. Similar deals happens very often e.g. when you are renting or leasing a car you still have to pay yourself for gas. Same with renting long term for accomodation you pay utilities yourself.
Post reply on HN