jQuery Forum

Anyone have any advice on this? I'm stuck...

Exposing your AUTH-KEY on the Internet would let any hacker use it.

Hello Jake.
There's a lot of confusing information surrounding api key exposure on the internet.I would have thought that the api-key was tied to my websites url. And if so, it would be useless to any one else?
Another thing I read was that using a jsonp callback, in an ajax request, actually overrides any custom headers (containing my auth-key). Could this be the reason for my 403 response?

Did you see documentation on JSONP @ auspost.com.au?

403 Forbidden

The server understood the request, but is refusing to fulfill it. Authorization will not help and the request SHOULD NOT be repeated. If the request method was not HEAD and the server wishes to make public why the request has not been fulfilled, it SHOULD describe the reason for the refusal in the entity. If the server does not wish to make this information available to the client, the status code 404 (Not Found) can be used instead.

JΛ̊KE

"Did you see documentation on JSONP @ auspost.com.au?"

I was advised by their Tech Support to use jsonp.......
Which brings me back to - Is it possible to set a custom header (with the AUTH-KEY) AND use jsonp?

I googled around and saw nothing about JSONP. Have you got a link where they discuss JSONP?

Thanks Jake.
It was through email contact with auspost Tech Support, in which they stated "Try using JSONP request it works against https-http without any problem".
This is where I read it can't be done:
http://stackoverflow.com/questions/3073287/set-headers-with-jquery-ajax-and-jsonp

JSON from PHP/ASP/Python/PERL/JAVA would work. It’s just JSON from JavaScript that has to worry about security.

Ok, thanks again for your help Jake.
They sent me this link which gives a very clear explanation and workaround (I hope it works ;-)).It may help another newcomer to jQuery.
Cheers.
http://christianheilmann.com/2010/01/10/loading-external-content-with-ajax-using-jquery-and-yql/

YQL is a good proxy service. Proxying with PHP or your favorite server language is probably better.