Ember-inspector: How do i disable ember inspector for my app in production environment?

[Koushikrad]

I want to disable the ember inspector for my app in a production environment. Though I have all kind of validations in the backend. Still, am not interested in showing up my data in the inspector. Is there any way to solve this?

[rwwagner90]

I don't know of a way to disable the inspector myself. @rwjblue is there a way to not ship the debug stuff in prod or something?

[Koushikrad]

@rwwagner90 check this #664 . Adding window.NO_EMBER_DEBUG is working fine when the app is launched and the inspector is not open. If I refresh the page with inspector open it doesn't work. So, thought you guys might know some workaround for it.

[rwwagner90]

@Koushikrad that issue sounds like it should work if you set it early enough before Ember loads. How are you setting it?

[koushik-radhakrishan]

I had the same in my app.js

[rwwagner90]

@locks do you have any insights into this? It looks like you helped solve this in the previous issue.

[Koushikrad]

Guys any update on this?

[rwwagner90]

@rwjblue @locks is there a way to not include ember_debug in prod builds? If not, window.NO_EMBER_DEBUG might be the best solution for now.

[evanb2]

Any update on this? It's been a year and this seems like a pretty big security issue...

[evanb2]

I was able to reproduce @koushik-radhakrishan 's issue locally. Refreshing the page with the inspector open will show the application data.

[jenweber]

If someone wants to reverse engineer a front end, the presence or absence of the Ember inspector both lead to the same result. As soon as front end code is served to the browser, it’s able to be deconstructed - this is true of any SPA for any framework. For apps that need to protect their source code itself, it’s best to require a login first and then serve up the front end app code, so that at least only authorized users could potentially introspect it. I worked on an app where it was quite important to not leak any industry info to the public, and that’s the approach we took. Anything less than that would have been security through obscurity, which is not security.

What the Inspector does is on par with Chrome/Firefox network request dev tools or the Chrome debugger. If it feels risky to have these tools functional, efforts should be put towards cutting that risk off before the code is ever served to the browser.

TLDR this may still be a worthwhile feature request, but it would not provide enhanced security.

[rwwagner90]

Well said @jenweber! I think we should close this for now.