Pogify API v2.0.0 Beta 3

Changelog

• Added blanket cors policy.

Pogify api v2 beta 2

pogify api v2 changes:

• endpoints are changed
  • old endpoints names were to keep in line with pogify-functions
• a new proof of work system for starting sessions

About Proof of Work

Pogify does not require any kind of authentication for basic usage and as such its difficult to rate limit the endpoint to start a session. This opens up the possibility of a malignant actor sending millions of requests to start sessions to reserve session IDs and closing the available IDs for other clients. By implementing a proof of work system to start a session, we can effectively limit the rate at which any individual client can claim access to a session. The new flow is as follows:

1. Clients request a new session problem to /issue
2. Clients calculate a hash that fulfills the difficulty set by the server
3. Clients requests a claim to a session using the solved problem to /claim
4. Server returns with a JWT that grants claim to that session ID.
   • when the session problem is issued the server does not check whether the session already exists.
   • this does mean that a client could solve a problem and not be able to claim a session because it already exists.
     • server will return a status 410 when such happens