Can a malicious user manipulate my application’s variables and display, for example, a modal with conditional rendering based on a variable?
Yes, via the Inspect Element panel
1 Like
oh no. I made many things in my app based on variables. I need to do a scan.
Thanks, Micah
The way variables should be used is to store authenticated user data, or operational data that’s okay to be exposed. If you’re trying to hide sensitive data in a variable, it can be exposed.
In the case of having properly authed users, it doesn’t matter that the user can see what is inside the variables because it’s their data. But if there is info they shouldn’t see, it should live in your backend that only properly authed users can access.
1 Like