How to store secrets

[robertocarroll]

Facebook API requires verification. If we simply host on Github, where are these details stored? Does it matter if they are visible?

https://news.ycombinator.com/item?id=9952356

[paulwaitehomeoffice]

If I understand correctly, if we’re hosting on Github Pages, then all our code will run in the browser, so we’ll be using the Facebook JavaScript SDK:

https://developers.facebook.com/docs/javascript/quickstart

We pass our Facebook app’s app ID to the JavaScript SDK when initialising it. I think (though I need to check this) that we then go to our Facebook app’s config page in Facebook, and enter the domain where our app is hosted. Facebook will then only accept API cals that come from that domain.

(I guess that means our Github Pages domain needs to be HTTPS.)

I guess each Amnesty section that uses the app will need to:

• create their own Facebook app id
• edit their fork to include their Facebook app ID
• host their fork on their own Github pages domain

Although maybe they can all use the same Facebook app ID, and/or be hosted on the same domain.

[robertocarroll]

Perfect. (Need to read those docs more carefully!)