Latitude 10 docs

Direct and proxy

Direct

The reader's browser calls your API itself, with what the form holds and nothing else:

  • no cookies: the request is sent with credentials: 'omit';
  • no referrer: referrerPolicy: 'no-referrer';
  • no redirects: a redirect shows as "The API answered with a redirect, which the playground doesn’t follow.";
  • only to the servers your document lists that pass the page's connect-src checks: see Caching and security.

Your API has to answer CORS for this to work: see CORS for Try it. The credentials a reader types stay in their browser.

Through the proxy

The API client’s proxy (Pro) calls only hosts you verified, follows no redirects and stores nothing.

An owner or admin turns it on for the project, and adds and verifies each host. Try it then offers it beside direct mode. The browser sends the request as a JSON envelope to /r/<workspace>/<project>/proxy, and our server makes one request, built from that envelope only:

  • https only, on the default port, with no user name in the URL, to a public host verified for this project;
  • GET, POST, PUT, PATCH, DELETE, HEAD and OPTIONS;
  • a body of up to 256 KB;
  • no cookies, no Origin or Referer, and none of the Host, Forwarded, X-Forwarded-*, CF-*, Sec-* or Proxy-* headers;
  • its own User-Agent, which names the Latitude 10 playground;
  • sent once, never retried, and never redirected;
  • cut off after 15 seconds, and its answer read up to 1 MB.

The answer comes back as JSON: the status, the headers without Set-Cookie, the body as text or base64, whether it was cut, and the time it took. Nothing the API sends becomes a page on our origin.

The proxy serves the hosted reference at /r/ and its embed. The reference inside a docs site sends directly.

The proxy's calls count per project a day and per reader's IP a minute: see Plans and limits.

The proxy's errors

StatusThe error
400What's wrong with the envelope, such as Send an https URL. or That method isn’t allowed.
403This host isn’t verified for this API’s proxy.
413The body is over 256 KB.
429Too many requests through the proxy. Wait a minute. or This API’s proxy has reached today’s limit. Send directly from your browser, or try tomorrow.
502The API couldn’t be reached.
504The API didn’t answer within 15 seconds.

Where this comes from

  • app/reference/_lib/playground/client.ts
  • app/reference/_lib/playground/proxy.ts
  • app/reference/_lib/playground/csp.ts
  • app/r/_lib/proxy.ts
  • app/r/[ws]/[project]/proxy/route.ts