search

MetaMask / api-playground

https://metamask.github.io/api-playground/api-documentation
Apache License 2.0
6 stars 12 forks source link

Prevent addresses from being added to the URLs #90

Open vandan opened 11 months ago

vandan commented 11 months ago

Though the playground isn't intended for use with sensitive information, we should still avoid including addresses in URLs to avoid any privacy risks.

The recent addition of analytics that are including URLs in the event parameters exacerbates this risk so it should be prioritized.

Here's an example of what's being passed when there are params included in the URL (there is some masking but that is from a third-party UI and doesn't mean they don't have the full address in their system):

analytics.page({
  path: '/wallet/reference/wallet_requestpermissions/',
  referrer: '',
  search: '?requestPermissionsObject[eth_accounts][account]=0***',
  title: 'MetaMask developer documentation',
  url: 'https://docs.metamask.io/wallet/reference/wallet_requestpermissions/?requestPermissionsObject[eth_accounts][account]=0***'
});

At the same time, we want to balance privacy against the developer experience. @BelfordZ recommends adding a "Copy" button to allow developers to save their input data from the playground in case they need it again later.

BelfordZ commented 11 months ago

just to clarify, the copy button would

  1. set the url params to include the request params
  2. copy the url into your clipboard