r/aws•
meruapps

Is it normal to put account IDs, ARNs, PoolIDs, etc. in client-side code?

Specifically, I was reading this example:

https://blogs.aws.amazon.com/security/post/Tx3LP54JOGBE0AY/Building-an-App-using-Amazon-Cognito-and-an-OpenID-Connect-Identity-Provider

and noticed that these identifiers are put into client side javascript. I can't really think of any exploits/insecurities if clients can see these identifiers, but exposing them to the public just kinda bothers me.

Is this considered best practice?

Edit: Apparently this is a feature, meant to make web apps without server side code:

https://medium.com/aws-activate-startup-blog/dynamic-websites-using-the-aws-sdk-for-javascript-in-the-browser-b3dd90c25b1e#.gslr2bjic

It's certainly different!

Posted Apr 15, 2016, 1:54 AM UTC · edited

73
Loading comments…