All things software & product, honestly - FrontEnd, BackEnd, DevOps, ML - as long as we're solving massive problems.
My code is used by millions of users globally - Potatoes make me happy
I believe a solution like this would work due to domain restrictions. I.e you can take the keys and user ID, but can only send/activate the service if the domain matches
Yeah that's somewhat a relief 😅. As a bad actor, I could still send thousands of messages, potentially causing increased cost or worse, the email account getting blocked.
This service seems convenient at first, but with today's serverless solutions it's worth building a backend solution that is properly secured.
I believe a solution like this would work due to domain restrictions. I.e you can take the keys and user ID, but can only send/activate the service if the domain matches
You could probably use that USER_ID from the devtools console of the appropriate domain and send whatever you want, impersonating the domain owner.
Edit: the FAQ of the service indicates you can only send predefined template emails, but template variable injection could be abused.
Yeah that's somewhat a relief 😅. As a bad actor, I could still send thousands of messages, potentially causing increased cost or worse, the email account getting blocked.
This service seems convenient at first, but with today's serverless solutions it's worth building a backend solution that is properly secured.
There is no way you can solve this problem by creating your solution. As a bad guy, I can just as well call your API for your form.