Skip to content

Conversation

@NikhilGangaram
Copy link
Collaborator

No description provided.

@NikhilGangaram NikhilGangaram requested a review from kcq888 February 7, 2026 22:22
const data = await response.json();
return data.model_name || 'XRPCode Buddy';
} catch {
return 'XRPCode Buddy';
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

shouldn't this be XRP Buddy?

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

leaving this to be a separate PR since seems like there are issues with the other one

if (this.handshakeToken) return this.handshakeToken;

try {
const response = await fetch(`${this.backendUrl}/handshake`);
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

How does the backend know that the client is XRPWeb? This call does not pass anything to the backend?

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

couple of thoughts:

  1. there is a trusted domains setting that only (easily) allows requests through the localhost
  2. the handshake creates a key in the backend that then is passed back to the front end. this stops a script from just "curling" our API thousands of times because it requires a state to be stored with the handshake key
  3. we can't really stop someone from emulating our frontend (since all of the code and schemas are open source). we could do so by storing a DB of users (emails and passwords) and can talk about this in in our next meeting

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants