6

I would like to make a security edit (but all the answers repeat the same concern). I don't know how to proceed with the edit, and that is why I'm bringing the issue up on Meta.

There is this message: Adding an .env file to React Project. The question asks about adding a SECRET in the front, and all answers answer without security concerning how to store the SECRET. Only this little comment does.

In the first case, I thought about editing the first answer:

  • Replace my-secret-api-key by my-public-api-key
  • Add a message, something like:

    Do not store SECRET, my-secret-api-key in the react/front, use a serverside to store and do your requests.

But what about the other messages? Should I do the same?

5
  • 8
    I'd say post a separate answer demonstrating storing the secret server side and using it. Close any other questions that ask the same thing as duplicates. Commented Nov 19, 2022 at 8:38
  • 1
    Is it worthwhile perhaps to close the question as a dupe of the one that triggered it? That one seems to better advise on security. The question under discussion seems not to really add anything in scope but it practically forces bad advice by the way it is posed. (I’m not an SME.) Commented Nov 19, 2022 at 9:51
  • @AbdulAzizBarkat What do you mean by "using it"? Commented Nov 20, 2022 at 4:52
  • 1
    @user2226755 I mean an answer that shows how the secret is stored on the server side and how the frontend utilizes it by calling the server. Commented Nov 20, 2022 at 4:55
  • 3
    I don't think you SHOULD edit any of that, as it is a conflict with the rule to not change the author's intent. Yes it sucks and it'll be a thorn in your side for forever especially when you see 300+ upvotes, there is plenty of material on Stack Overflow that is "not a good idea" or a more drastic version of that description. Cast your downvotes, add your comment and move along.
    – Gimby
    Commented Nov 21, 2022 at 15:41

0

You must log in to answer this question.