Domain is blocked [github.com]

[MNThomson]

Since a shield for the number of contributors to a GitHub Org doesn't exist (and it doesn't appear to be an easy addition), I've hacked together a script to output the number of unique contributors. This data is stored on GitHub, yet I cannot use it since the badge displays Domain is Blocked......I cannot find any explanation why GitHub is blocked for custom endpoints. Could somebody please elaborate?

Related Code:

shields/services/endpoint/endpoint.service.js

Line 8 in 23c0406

const blockedDomains = ['github.com', 'shields.io']

shields/services/endpoint/endpoint.service.js

Lines 67 to 69 in 23c0406

	if (blockedDomains.some(domain => hostname.endsWith(domain))) {
	throw new InvalidParameter({ prettyMessage: 'domain is blocked' })
	}

[calebcartwright]

Because GitHub rate limits their APIs fairly aggressively, exceptionally so for unauthenticated requests. We deal with a fairly large volume of badge requests which means that we send a lot of API traffic at GitHub, and in order to avoid hitting the rate limits and having all of our GitHub badges taken offline, we have to authenticate all those requests.

We can't start sending GitHub auth tokens from our pool to random user-defined endpoints, nor can we let someone "use" the endpoint badge to simply fetch content from GitHub anonymously directly from our servers as it would be a huge surface for abuse and DOS of our GitHub badges (which is the most used badge family we provide).

There's a number of viable, supported ways to get badges with content from GitHub

• Use one of our native GitHub badges (go to shields.io and search for 'github' via the search box at the top)
• Use our Dynamic badge with a raw.githubusercontent.com based url that allows using json path to query the badge message value
  • https://shields.io/#your-badge -> https://img.shields.io/badge/dynamic/json?color=blue&label=foo&query=%24.formation.web.quantity&url=https%3A%2F%2Fraw.githubusercontent.com%2Fbadges%2Fshields%2Fmaster%2Fapp.json
• Use the Endpoint badge in the intended model, where you actually deploy a custom endpoint (e.g. in a free service like runkit) and it is your custom endpoint that makes API calls to GitHub, e.g. Shields server --> your endpoint (runkit) --> GitHub API

[MNThomson]

Awesome, thank you for the explanation. Makes total sense!