rdgifford / profile Goto Github PK

Server side rendering seems to be the way to go to dynamically load content lists. Securing third-party API keys is going to mean making third party API requests from the server:

"As for any functionality in your application that requires you to communicate with a third party API you don’t control, the answer is to make a simple CSRF secured AJAX call to your own back-end and then let your server-side application make the API call on behalf of your front-end then return the response back to your client-side app.

In this way your API credentials are secured. Your keys can’t be leaked unless you somehow return them back to your front-end or someone hacks into your server and somehow gets a hold of your configuration files or environment variables."