[create-plasmic-app] next js security improvement 🔐

plasmicapp / plasmic

Visual builder for React. Build apps, websites, and content. Integrate with your codebase.

https://www.plasmic.app

MIT License

4.69k stars 377 forks source link

[create-plasmic-app] next js security improvement 🔐 #88

Closed guaiamum closed 6 months ago

guaiamum commented 1 year ago

I was about to commit code from the auto generated changes in create-plasmic-app script and noticed the secrets about to go to repo, I'm not sure how that really impacts security but have a hunch this info shouldn't be there...

There's no easy way I found to revoke previous api token in studio as well, so I'm guessing safe than sorry?

Since nextJS supports dotenv files natively and .env.local is auto ignored in git tracking, thought of adding this, wdyt?

yang commented 1 year ago

Hello, thanks for submitting this!

Regarding the security issue: The project ID and token are meant to be public. They only grant you the ability to render the project whose website you are already looking at.

But moving configuration into data files is nice and common practice!

its-a-lisa commented 8 months ago

This is something I'm wondering about; because if the project IDs are public, then does that mean that anyone with the project ID can open the plasmic project if the owner doesn't have Auth set up for their project?

yang commented 8 months ago

Only if you have share by link enabled! You should be able to set your projects to be private.