React-starter-kit: How to secure redux data-initial-state

[fchienvuhoang]

Hi all,
Have any way to secure redux data-init-state below image:

[upq]

+1
it feels odd seeing everything just laid out there for everybody. I know you can get that data if you want but at least not straight forward like that.

[frenzzy]

Enable Content Security Policy

[fchienvuhoang]

Hello @langpavel, how do you think ? :)

[voquockhanh]

+1

[alexsuslov]

You need to hide information on the transfer or make not readable?

[fchienvuhoang]

yeh, could hide it ?, or some way to encrypt it. I think data can be leaks when see them in data-initial-state.

[alexsuslov]

may be base64 ?
console.log(btoa("test"));
dGVzdA==
console.log(atob(btoa("test")));
test

[fchienvuhoang]

May be... But encryption - decryption it's the best option ? :)

[alexsuslov]

there is an option to do bit operations. they are fast.
or https://www.npmjs.com/package/crypto-js

[fchienvuhoang]

I argee with you, and I think it's the best way. Thanks @alexsuslov

[langpavel]

Security by obscurity is no security at all. If you are unhappy to see this in, you can just delete data-initial-state attribute in DOM after it value is readed here. But this will do not protect your data.

[langpavel]

@alexsuslov If you need decrypt data on client, you need key on client. It is not secure because all you need for decrypting can be achieved

[fchienvuhoang]

how to ! :|

[langpavel]

Closing this with only real solution from @frenzzy: Enable Content Security Policy

[fchienvuhoang]

Thanks @langpavel