Conversation

Security question: there's a web API I want to use that doesn't support CORS, so I can't directly access it from JavaScript

I span up a proxy server which proxies to the API and adds CORS support, and it works - now I can call it from JavaScript

Are there any reasons NOT to use this technique in production, or release it to the wider world?

It's an API-key protected API so it wouldn't be providing access to anyone without an API Key