faceyspacey / redux-first-router

🎖 seamless redux-first routing -- just dispatch actions
MIT License
1.56k stars 143 forks source link

Route Paths Visible to Everyone #226

Closed xpromx closed 6 years ago

xpromx commented 6 years ago

Hello,

I'm starting using redux-first-router, but I noticed that in the source code the defined routes are in the location.routesMap object inside the redux initialState, I know that it may be essencial to make it works, but from my side it can be a security hole and I don't want to show these routes to everyone. small websites maybe ok, but I'm trying to make a e-commerce and there is many private routes that I don't want to show.

I also know that I can load routes dynamically, but for example, in the payment process a normal user can see all the paths and it may require more security for my side.

Is there a better way or recommendation about this?

Thank you.

faceyspacey commented 6 years ago

Load em dynamically. Code splitting is the only way to make them less apparent. If you don’t like the json in initial load if u r doing SSR, mangle and unmangle them or something.

The same is true for React Router or anything—the routes are in your mimicked obfuscated code. In this case you have SSR hydration it sounds like. If that’s what’s really bothering you, find a way to mangle it and unmangle it so it’s less obvious. After all, the routes will never be private and always accessible to someone that wants to find them.