Security issues related to devtools usage

[Cyprien Thao]

Hi,

This is not really a problem declaration, I wanted to know is it as possible to prevent this extension from working.
It allows users to edit the state of a Vuex store in production, which something problematic on my application.

So is there a way to ensure the extension wont work on my app ?

[Preston Holt]

(Disclaimer: I have nothing to do with this package besides occasionally using it to debug in production)

@ChronicStone I think anyone who intentionally uses devtools on a production website also understands that tinkering with a Vuex store could cause problems during the session. As long as you keep all secrets and business logic on the server side (which shouldn't be on the client anyway), any malicious actions won't be successful. If there is a way to prevent this extension from working, a motivated person could bypass that as well.

See also:
vuejs/devtools#190 (comment)

[hzmming]

The original intention of this browser extension is mainly to facilitate debugging of Vue online applications. Browser web pages lack security, so it is recommended that important logic be placed in the server-side interface.