Skip to content
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.

Commit d326cc5

Browse files
stainless-app[bot]stainless-bot
authored andcommittedSep 6, 2024
chore(docs): update browser support information (#1045)
1 parent 7e04428 commit d326cc5

File tree

1 file changed

+8
-2
lines changed

1 file changed

+8
-2
lines changed
 

‎README.md

+8-2
Original file line numberDiff line numberDiff line change
@@ -618,16 +618,22 @@ The following runtimes are supported:
618618
- Jest 28 or greater with the `"node"` environment (`"jsdom"` is not supported at this time).
619619
- Nitro v2.6 or greater.
620620
- Web browsers: disabled by default to avoid exposing your secret API credentials. Enable browser support by explicitly setting `dangerouslyAllowBrowser` to true'.
621-
<details>
622-
<summary>More explanation</summary>
621+
<details>
622+
<summary>More explanation</summary>
623+
623624
### Why is this dangerous?
625+
624626
Enabling the `dangerouslyAllowBrowser` option can be dangerous because it exposes your secret API credentials in the client-side code. Web browsers are inherently less secure than server environments,
625627
any user with access to the browser can potentially inspect, extract, and misuse these credentials. This could lead to unauthorized access using your credentials and potentially compromise sensitive data or functionality.
628+
626629
### When might this not be dangerous?
630+
627631
In certain scenarios where enabling browser support might not pose significant risks:
632+
628633
- Internal Tools: If the application is used solely within a controlled internal environment where the users are trusted, the risk of credential exposure can be mitigated.
629634
- Public APIs with Limited Scope: If your API has very limited scope and the exposed credentials do not grant access to sensitive data or critical operations, the potential impact of exposure is reduced.
630635
- Development or debugging purpose: Enabling this feature temporarily might be acceptable, provided the credentials are short-lived, aren't also used in production environments, or are frequently rotated.
636+
631637
</details>
632638

633639
Note that React Native is not supported at this time.

0 commit comments

Comments
 (0)
Please sign in to comment.