securing credentials on front end react-native

user_13789135 0
Viewed 142

I am creating an app using react-native. This app requires some sensitive data which must be stored securely and there are various options for that e.g, expo-secure-store.

Now i am a but confused regarding securing the data on front end.

I am using react-native-async-storage to store other data on front end.

Now it is treated as a bad practice to use the same for sensitive data.

But my question is, say i use expo-secure-store for sensitive data, but at the time of saving it like this;

SecureStore.setItemAsync(key, value);

where value is the sensitive part, isn't that still getting exposed while setting it in the code.

Please explain this and describe some better practices to store (or access) sensitive data on front end.

Thanks!

react-native api-key frontend security
1 Answers

The documentation for the Google Maps Android SDK has instructions for restricting the API key usage to an app fingerprint: https://developers.google.com/maps/documentation/android-sdk/get-api-key

This reduces the risk of including the key in your app by only allowing the key to be used from a source that matches the fingerprint of the app certificate.

In practice the value of a Google Maps API key is fairly low, and is not the most attractive target for a bad actor. Frontend API keys are sensitive in that you can be billed for their usage, but unless you are specifically targeted, it's not a likely attack vector.

Truly sensitive keys, like those used to generate auth credentials or payment data, should always be kept on the backend, and any decent third-party service will be set up in a way that forces this to be the case (for example, Stripe).

You may get better answers by asking how or when to store specific keys.

user_107186410
Related