4

I'm building a very big website project in ReactJS which handles money so I'm kinda paranoid when talking security.

I have a Login component which has a state composed by "email" and "password". Those values are populated by typing in the corresponding input field. The actual login structure is very secure anyway because I'm using jwt with public and private key and a CSRF token.

My problem is that I don't know how secure is to store email and password in the local state. Can it be easily accessible by cross-site scripting or can it only be visible by a React Chrome extension? From what I know, state should not be persistent. Can anyone solve my doubt?

(please don't hate me for some English mistakes, I'm italian so "mamma mia pizzeria")

Oscopoldo
  • 51
  • 4
  • Storing anything in React's State is perfectly safe. It's basically just a global variable that's accessbile to all components and is non-persistant i.e. dies when browser closes. – TheCarver Jan 04 '23 at 18:15

1 Answers1

2

to store email and password in the local state

This is a very bad idea. Storing sensitive data on client is always risky as it can be retrieved using dev tools. It will be time consuming but achievable. And since your product deals with money, you should be paranoid.

A better way would be to create a login form and on success, send a CSRF_TOKEN or any hash. Store this hash and validate it for every request along with IP or any other unique generated value.

Ideally, you should not save UserName/Email and Password. If you wish to display user name or username for greeting, keep a Nickname property in User class and use it. That way you are not exposing any important information.

Email is also a vital information as someone can send a fishing email and trick user into giving important details. You can look into Secure Cookies and other ways, but storing on local state/ local store is always bad

Rajesh
  • 24,354
  • 5
  • 48
  • 79
  • Downvoted: storing a password in state is 100% safe and is no different from storing a password in a variable because. funnily enough, it is just a global variable that's accessible by all components/modules in your application. – TheCarver Jan 04 '23 at 18:09
  • @TheCarver a variable is not accessible. State can be using react dev tools. But its opinionated so its alright – Rajesh Jan 05 '23 at 03:26