Security concerns for client side implementation

[ryandotsmith]

I am wondering if it is recommended to use this for tracking client side JS errors. If it is the intent to have this library support client side operation, how should I authenticate my honeybadger requests?

cc: @glaksmono

[sahin]

Ryan, we are using honeybadger for a long time in our startup, movielala.com.

there is 2 types of errors u can catch.

1. window.error
2. or u can catch inside your try{} catch{}
   There is no security issue , because these error will be shown in the console any way or js code....

honeybadger requests , u will add your key in js, this is not a security issue too, because all the key of services like ga, mixpanel, facebook, open to every one... and has a domain name matching... so noone can use it...

I hope these answers your question...

[starrhorne]

Hi Ryan,

Yep, this library is intended for client side error tracking.

Your front end api key is not the same as your back-end api key, so the back-end key won't be exposed.

When using the client-side API there's always the possibility that someone could use the JS debug console to send you fake errors. But that's just the nature of client-side JS.

Best,
Starr

[ryandotsmith]

Thanks! I am excited to integrate our client side and server side errors!

[starrhorne]

Sweet. :)

If you have any other questions feel free to email us at support@honeybadger.io.

Best,
Starr