确保 Redux 状态的存储并防止在浏览器开发工具中可见。

huangapple go评论57阅读模式
英文:

Ensuring storage of Redux state and preventing visibility in browser Developer Tools

问题

我需要关于如何安全地本地存储Redux状态的指导,确保它无法通过浏览器开发工具访问或显示。我想了解metamask-extension用于实现这种安全级别的安全策略和技术。任何见解、代码片段或推荐的最佳实践都将不胜感激。

我尝试使用redux-persist-transform-encrypt来加密和本地存储Redux状态。

const encryptKey = encryptTransform({
  secretKey: "secrete-key",
});

const encryptionTransform = createTransform(
  (inboundState, key) => {
    return encryptKey.in(inboundState, key);
  },
  (outboundState, key) => {
    return encryptKey.out(outboundState, key);
  }
);

const customStore = localforage.createInstance({
  name: "Extension",
  storeName: "Extension Storage",
});

const persistConfig = {
  key: "root",
  storage: customStore,
  transform: [encryptionTransform],
};

const rootReducer = combineReducers({
  appState: appStateReducer,
  wallet: walletReducer,
  userPreferences: preferenceReducer,
  connectedWebsites: connectedWebsiteReducer,
  announcements: announcementsReducer,
  language: languageReducer,
});

const persistedReducer = persistReducer(persistConfig, rootReducer);

export const store = configureStore({
  reducer: persistedReducer,
  devTools: false,
  middleware: (getDefaultMiddleware) =>
    getDefaultMiddleware({
      serializableCheck: false,
    }),
});

export const persistor = persistStore(store);

然而,我遇到了一个问题,加密数据仍然在浏览器的开发工具中可见,名称为 persist:root

与此相反,metamask-extension成功隐藏了持久化数据,并安全地将加密的存储在以下本地位置:

C:\\Users\\USER_NAME\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\nkbihfbeogaeaoehlefnkodbefgpgknn

我正在寻求如何实现类似于metamask-extension所实现的加密持久化Redux状态的安全存储的指导。

英文:

I need guidance on securely storing the persisted Redux state locally, ensuring it cannot be accessed or displayed through browser development tools. I want to understand the strategies and techniques used by metamask-extension to achieve this level of security. Any insights, code snippets, or recommended best practices would be highly appreciated.

I have attempted to utilize redux-persist-transform-encrypt to encrypt and store the Redux state locally.

const encryptKey = encryptTransform({
  secretKey: "secrete-key",
});

const encryptionTransform = createTransform(
  (inboundState, key) => {
    return encryptKey.in(inboundState, key);
  },
  (outboundState, key) => {
    return encryptKey.out(outboundState, key);
  }
);

const customStore = localforage.createInstance({
  name: "Extension",
  storeName: "Extension Storage",
});

const persistConfig = {
  key: "root",
  storage: customStore,
  transform: [encryptionTransform],
};

const rootReducer = combineReducers({
  appState: appStateReducer,
  wallet: walletReducer,
  userPreferences: preferenceReducer,
  connectedWebsites: connectedWebsiteReducer,
  announcements: announcementsReducer,
  language: languageReducer,
});

const persistedReducer = persistReducer(persistConfig, rootReducer);

export const store = configureStore({
  reducer: persistedReducer,
  devTools: false,
  middleware: (getDefaultMiddleware) =>
    getDefaultMiddleware({
      serializableCheck: false,
    }),
});

export const persistor = persistStore(store);

However, I encountered an issue where the encrypted data is still visible in the browser's developer tools as persist:root.

确保 Redux 状态的存储并防止在浏览器开发工具中可见。

In contrast, metamask-extension manages to hide the persisted data and securely store the encrypted vault/state in the following location locally:


C:\\Users\\USER_NAME\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\nkbihfbeogaeaoehlefnkodbefgpgknn.


I am seeking guidance on how to achieve similar secure storage of the encrypted persisted Redux state as implemented by metamask-extension.

答案1

得分: 2

Metamask是一个浏览器扩展程序,可能使用其中一个用于浏览器扩展的“storage”解决方案,这可以解释你找到的那个文件。我会假设他们使用的是storage.local,不要与localStorage混淆,后者用于网站,而不是扩展程序。

英文:

Metamask is a browser extension and probably uses one of the storage solutions for browser extensions, which would explain that file you found. I would assume they use storage.local, which is not to be confused with localStorage, which is to be used by websites, not extensions.

huangapple
  • 本文由 发表于 2023年5月25日 02:04:37
  • 转载请务必保留本文链接:https://go.coder-hub.com/76326310.html
匿名

发表评论

匿名网友

:?: :razz: :sad: :evil: :!: :smile: :oops: :grin: :eek: :shock: :???: :cool: :lol: :mad: :twisted: :roll: :wink: :idea: :arrow: :neutral: :cry: :mrgreen:

确定