𝗘𝘃𝗲𝗿𝘆𝗼𝗻𝗲 𝗰𝗮𝗻 𝘀𝗲𝗲 𝘆𝗼𝘂𝗿 𝗦𝘁𝗿𝗶𝗽𝗲/𝗢𝗔𝘂𝘁𝗵 𝘀𝗲𝗰𝗿𝗲𝘁 𝗸𝗲𝘆𝘀 your react app's secrets are public. they're in the bundle, waiting to be read by claude or gpt. we moved sensitive configs out of the build entirely. people generally do this .env → webpack → bundle.js → "STRIPE_API_KEY": "sk-abc123" (plaintext) i propose (and am using) app start → fetch encrypted config from /api/config → decrypt in memory → never gets written to files interestingly, the decryption is done in the browser, not the server. the backend sends an encrypted payload that requires multiple runtime components to decrypt. the decryption key gets assembled from different sources: the user's auth token provides one component, a device fingerprint provides another, and the current time window provides a third. each piece alone is useless. no single component can decrypt alone. an attacker would need: • valid auth session • correct device fingerprint • current time window • the encrypted payload • the combination algorithm not to mention all of this decryption code is minified and obfuscated. in doing so, we have introduced a lot of complexity into fetching the relevant secrets for our runtime. we now also have a way to detect if someone is trying to access the config. of course, this is not bulletproof, JavaScript in the browser can always be reverse engineered with enough effort. but there's a huge difference between: "found your API key in 5 seconds with grep" vs "spent hours reverse engineering your runtime decryption." for most applications, that's the difference between leaked keys on day one and practical security. in combination to this, we should also implement rate limiting, request signatures, and canary tokens. defense in depth. are you still storing your stripe keys in .env.production and hoping for the best? #WebSecurity #Frontend #JavaScript #DevSecOps
Hey, would love to get a more detailed session! Can you suggest some good blog posts to study this in details? Supriyo Roy Da??
Actually Stripe, Oauth were never meant to be implemented through frontend... there is a risk of exposing secrets.......they most of the cases don't follow SOLID ...