Security Issue: Internal API URL and Token exposed in client code.

langgenius / webapp-conversation

MIT License

444 stars 832 forks source link

Security Issue: Internal API URL and Token exposed in client code. #79

Open racerxdl opened 4 months ago

racerxdl commented 4 months ago

Currently the env APP_URL is getting exposed directly on client side because webpack adds it to the bundle. This is an issue because it exposed information about internal infrastructure and even the token for acessing the API directly.

racerxdl commented 4 months ago

PS: This can be solved by removing the _PUBLIC prefix on the env variables (since they only need to be at backend side)