Hiding sensitive data during an API request

[alanakra]

I'm currently working on a form with Next.js whose data is sent to a Trello board via the latter's API.

This one works well, I have my data sent and I have a response, however I use an API key and a token that even stored on a .env file are visible on the HTTP headers which poses a security problem.

The other concern is that I am using Vercel for hosting which is serverless and cannot send information. So I wanted to know if you know of a cloud service that can handle this.

Hiding sensitive data during an API request from a serverless app

Update the question so it can be answered with facts and citations. This will help others answer the question. You can edit the question or post a new one.

[logantai24]

@alanakra instead of directly sending out sensitive data (API token) in frontend, you might consider using the api routes functionality of Nextjs?

Nextjs App (frontend)
Sends a POST request to an api route you created, which includes the form data.

API (Vercel Serverless Functions)
Retrieve the form data, send a POST request to the trello API and write that form data to Trello. Sensitive data is store in env which only exposes to this API.

By doing so, the sensitive data will not be exposed in browser as all the actual send form data to trello API logic is done within the API endpoint you created in the pages/api/ folder.

[alanakra]

I'll try this way. Thanks

[elouisramsey]

@alanakra were you able to achieve this?

[alanakra]

@elouisramsey Hello,
This was a project during my end of study internship in a company. I was able to do it, but I don't have access to the source code anymore.

[afaqahmedkhan]

@elouisramsey were you able to achieve this?

[elouisramsey]

Hello, ended up encrypting and decrypting the data on the FE and BE, that seems to work for now

…

On Thu, 16 May 2024 at 10:52 PM, Afaq Ahmed Khan ***@***.***> wrote: @elouisramsey <https://github.com/elouisramsey> were you able to achieve this? — Reply to this email directly, view it on GitHub <#28284 (reply in thread)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AM6R57OOHKMSPF2BMU3C7MDZCUTAPAVCNFSM5CNYXH62U5DIOJSWCZC7NNSXTOKENFZWG5LTONUW63SDN5WW2ZLOOQ5TSNBWGMYTCOI> . You are receiving this because you were mentioned.Message ID: <vercel/next .***@***.***>