What I’m trying to do:
Learn more about the best practices of thee application of secrets.
Should I only be using the secrets service for tokens/private information that NEEDS to be on the client side and instead it hard coded on the server for tokens only needed on the server side?
For instance, the google geocode api. I could had my key to my secrets and make calls on the client side, but according to this quote:
Maybe I am miss understanding this quote, but I am interpreting it as “The secrets module is a defense layer, but still penetrable”, and I beleive, but do not know, if that key would be safer hard coded on a server module.
Anything on the client can be seen by someone determined enough, so that’s the right interpretation.
Server modules do not get sent to the client, so in that respect, a key hard coded into a server module cannot be seen by users.
But server module code is cloned when you give someone a clone link, so that secret would be exposed to anyone who clones your app (e.g. when you ask a question on the forum and give a clone link).
The secrets service would protect against that level of exposure.
So would it be more secure to hard code on the server and make my geocode calls all done on the server side vs. putting it in a secret and using the anvil-built-in google api service + restrict my api to my domain?
All this with the intent of not sharing the application via clone link.
Meredydd’s talking specifically about the interface between client and server code. And he’s not talking about Anvil’s built-in secrets module at all.
From the docs: "anvil.secrets functions can only be called from Server Module code (not client code, or even Uplink code)." So Anvil secrets are only for the server side. They allow you to share your server code via clone link or like on GitHub without exposing secrets, and they also protect you against these threats.