Secure / Encrypt Fetched-Data

[jrodl3r]

Seeking solution for securing/encrypting fetched-data.

even after enabling HTTPS, all fetched-data is still raw-accessible in the console as {'human-readable': 'response-data'}.

Ideally, fetched-JSON response would arrive via https protocol, encrypted to keep from peering eyes.

[choonkending]

Not an expert in this area, but definitely a fan of improving our security.

Do you want a

Encrypt in browser -> Decrypt in server

Encrypt in server -> Decrypt in browser

sort of model? I have 0% knowledge in this, but we could work to find out what a good way of doing this is.

On a side node
We should add helmet into our express to improve security.

References
Security best practices

[ZeroCho]

I'm running a blog based on reactGo, and I think we need to add data-encryption and prioritize it because initial data is shown to everyone who knows how to use browser console.

For example, my blog has a problem that members' emails are scraped by search engine and robots. This is not what my members want.

One more thing. I added helmet into my blog and it works well. Helmet protects from various threats and it's very simple to use.
app.use(helmet());

[choonkending]

Agree with both your points. We should priority security as well as performance.

• Add helmetJS #119 Do you wanna create helmet as a PR?
• Data encryption

I'm not sure what data encryption approaches we should take, do you have any ideas? I'll need to start researching on ways to handle this.

[ZeroCho]

@choonkending #429 here is PR

[jrodl3r]

Very cool @ZeroCho 👍

@choonkending We should definitely add the option to [ Encrypt-on-Server » Decrypt-on-Client ]
However, I'm not sure if the async-POST-data is being encrypted as it's sent from the browser to the server... (will have to inspect this more and confirm). Whichever direction the data flows, we should make it easy to secure.

[choonkending]

Good work guys! I might have to handball this to @jrodl3r and @ZeroCho (and whoever is interested) as I'm focused on improving offline support and performance for this and next week!

[jrodl3r]

@ZeroCho experimenting with a few object encryption pkg's (ex: sehrope/node-simple-encryptor).

getting the response object data encrypted and sent back is a breeze, but the only problem is that there's nowhere to hook into that response and run decrypt() ...Fetch (promises) doesn't have Success or Failure handlers to hook into before the reducer gets called... Any ideas?

[ZeroCho]

@jrodl3r How about decrypting inside the reducer? Like const decryptedResult = decrypt(action.result);

[jrodl3r]

@ZeroCho is that really the right place to be doing that? I'm not 100% sure about that.

I tried it anyway, doesn't work on the client/browser, but it does on the server =(

[ZeroCho]

This is what I think we need to do for encryption.

• The data is stored encrypted on the server.
• It was encrypted using a public key.
• The server sends the encrypted to the client.
• The client needs to decrypt it using their local private key. (This should be done in reducer or promiseMiddleware where fetched data comes to the client first)

The thing is, how we can get local private key securely.

By the way, I think we need to encrypt and decrypt window.INITIAL_STATE only, because we already use SSL(https) and get/post requests are handled via https.

[jrodl3r]

that sounds pretty good. I would think process.ENV for the private key, eh? Heroku config on Prod, git-ignored local secret on Dev?

I completely agree about window.INITIAL_STATE ...weird seeing the app state hanging out in view-source =\

As for SSL, even when it's configured, enabled and accessed + confirmed via HTTPS:// ...the Fetched Object Data is unencrypted, totally raw. I'm not sure why, wondering if there is something in Express (enforce-ssl) that we are missing...

[ZeroCho]

We need to find the encryption & decryption package which can be used in both client and server.

[ZeroCho]

@jrodl3r CryptoJS seems suitable for both client and server.
I'll try to encrypt window.INITIAL_STATE first.