如何防止有人窃取 API feed？
我已经开始开发一个网页，最近雇了一个人编写代码，在 http 的中间面板中显示自定义提要（由 API 提供支持） ://farmball.com/。 请注意，这不是与网站博客相关的 RSS 提要。该提要与我在另一个网站上的帐户相关联。没有可供普通用户订阅提要的 RSS 链接。我已经将该网站退出维护模式，询问这里任何有抓取/黑客经验的人如何最容易地“获取”提要并将其显示在自己的网站上。更重要的是，我能做些什么来预防它？
^更新措辞
I have started developing a webpage and recently hired someone to write code to display a customized feed (powered by API) in the middle panel on http://farmball.com/. Note that this is not the RSS feed tied to the site blog. The feed ties to my account on another site. There is no RSS link for an average user to subscribe to the feed. I've taken the site out of maintenance mode to ask anyone here with scraping/hacking experience how someone would most easily go about 'taking' the feed and displaying it on their own site. More importantly, what can I do to prevent it?
^Updated for re-wording
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（5）
你不能。
如果您要公开 RSS 提要，而您不希望其他人能够在其网站上显示该提要，那么您就完全错过了 RSS 的意义强>。 非常简单联合的全部原因（ RSS）的目的是使您的内容可供外部使用 - 无论是在 RSS 阅读器中还是通过某人在自己的网站上简单地打印其内容。
如果您不希望有人能够使用 RSS 提要，为什么还要包含它呢？
You can't.
If you are going to expose an RSS feed which you don't want others to be able to display on their site then you are completely missing the point of RSS. The entire reason for Really Simple Syndication (RSS) is to make your content externally consumable- whether that's in an RSS Reader or through someone simply printing its content on their own website.
Why are you including an RSS feed if you do not want someone to be able to consume it?
什么都没有。防止重用违背了 RSS 的基本概念，即让任何人都尽可能轻松地用它做任何他们想做的事情。它从一开始就被设计为非常容易联合，而不是在未经许可的情况下难以转发。
您可以仅通过让受信任的用户提供一些凭据或传递提要密钥（例如
yoursite.rss?mykey=abc123）来限制对提要本身的访问。 。但你无法控制使用。只能访问。Nothing. Preventing reuse goes against the basic concept of RSS, which is to make it as easy as possible for anyone to do anything they want with it. It was designed from the ground up to be Really Simple to Syndicate, not Really Hard to Retransmit Without Permission.
You could restrict access to the feed itself to trusted users only by making them provide some credentials or pass in a key to the feed (e.g.
yoursite.rss?mykey=abc123). But you cannot control use. Only access.明确您的许可证。正如其他人提到的，它不是一种技术解决方案，该技术是一种开放技术——这不是 DRM！但是，如果您在每个帖子中要求使用此提要的人不要转发/未能给予信用/等，那么有些人会回应该请求。
否则，您最好将内容置于密码后面并使用付费订阅模式来分发您的内容。
Be explicit about your license. It isn't a technology solution, as others have mentioned, the technology is an open technology-- this isn't DRM! But if you ask in each post that people who use this feed to not repost/fail to give credit/etc then some people will respond to the request.
Otherwise, you're better off putting your content behind a password and using a paid subscription model for distributing your content.
这本质上是一个 DRM 问题。如果您有某种技术可以将内容放到网络上而不需要重新分发，那么音乐行业就会喜欢您。
可以尝试阻止重新分发。您可以尝试的一种技术是将某种签名嵌入到您需要注册的每个用户的提要中。如果在网络上发现该内容，您可以识别并禁止重新分发您的内容的用户。
通过获取多个帐户并标准化内容以删除指纹，这也是可以避免的。对于潜在的盗版者来说，这需要付出比他们愿意投入的更多的努力。您的签名可能是独特的空白模式、帖子时间戳的微小差异、视频中错位的像素或任何其他您可以稍微改变的东西在最终用户没有注意到的情况下。
This is a DRM problem essentially. If you had some technique that you could put content on the web without having it redistributable, the music industry would love you.
It is possible to try to prevent redistribution. One technique you could try is embedding a signature of some sort into the feed for each user who you require to sign up. If the content is found on the web, you can identify and ban the user who redistributed your content.
This is avoidable too, by getting multiple accounts and normalizing the content to remove fingerprints. For the would-be pirate, this requires more effort than they may be willing to put in. Your signature could be a unique whitespace pattern, tiny variances in the timestamps on posts, misplaced pixels in videos, or any other thing you can vary slightly without end users noticing.
使用.htpassword
更好的是，不要将私密的东西放在公共场所，因为它可能会被软件自动获取。就像其他人所说的那样，这是一个非常奇怪的问题，如果您想弄清楚其他问题，最好明确说明您想知道的内容。
use .htpassword
better yet, don't put something private in a public place where it's likely to get picked up by software automatically. Like others have said, it's a pretty odd question, if you're trying to figure something else out, you're better off being explicit with what you want to know.