4 ms·
Is is a bit more nuanced than that. This web client needs access to non-secret keys that are passed via environment variables. This is absolutely commonplace.
by ratww 5y ago
Is is a bit more nuanced than that. This web client needs access to non-secret keys that are passed via environment variables. This is absolutely commonplace.
However there are two real issues here: first, some bug in the code is causing all environment variables to be dumped into the JS bundle. You can see that in inane keys like PATH, HOME, PORT.
This issue wouldn't be such a huge problem by itself. The second problem is that during the build process for the frontend, there are environment variables that shouldn't be there, such as the secret ones. The CI or build machine should have been well isolated enough to prevent this problem from happening.
This is a problem in the CI coupled with a bad build process.
- greggsy 5y agoGreat explanation - client side apps often seem to be a bit of a catch-22 in some cases.
- danenania 5y agoIt’s crucial to always use an allow-list approach to passing config through to a client.
- ratww 5y agoYep. Maybe just forbidding enumerating environment variables in the runtime would be enough for this case. However the CI shouldn’t have backend-only private variables available to frontend builds… some separation here would be safer regardless of developer mistakes.