1

I am very familiar with Apex Crypto class and it works pretty well. Now that I am trying to make my Aura component work more efficiently without making Server calls to encrypt/decrypt a large JSON string, is there a way I can perform Crypto operations within my Aura component itself (JS file)? Any references to SF articles or thoughts would be really appreciated.

Update to include more details:

We have a console application where most of our customer data flows from our internal API. Our console has a parent Aura component where it gets the necessary API data. The child components feed on this API data and we have workspaceAPI implementation to pass along the retrieved data via pageReference.state.

This console is accessed by our business team to work with customer cases. As we are including all data in the URL, I am trying to implement encryption on one of the URL parameters that holds customer's PI data. I would need encryption to hide the customer's PI data from our business users. The child aura component(s) render only few fields from this PI data. And the reminder of the data is still useful, but for different components.

Improve this question
6
  • What's the security objective you're aiming to accomplish by this? Performing encryption in client-side JavaScript has a few very specific applications but often is the wrong solution pattern.
    – David Reed
    Commented Dec 1, 2021 at 19:58
  • I wasn't sure if it's a good pattern or otherwise. I am trying to encrypt some data, which I will be passing to child components via PageRefernce.state
    – Austin Evans
    Commented Dec 1, 2021 at 20:01
  • Understood, but why are you encrypting the data? Who are you defending it from?
    – David Reed
    Commented Dec 1, 2021 at 20:20
  • To secure(hide) PI data of the customer at the URL. Also, another question: Encrypting data would decrease the total length (in chars)?
    – Austin Evans
    Commented Dec 1, 2021 at 20:52
  • 1
    This is an X-Y Problem. What you're asking doesn't make sense, as David stated. It sounds like you're trying to hide PI data from the person who's PI data it is. Does that make sense to you? And if it's just about a URL mechanism, why have the PI data in the URL at all? Also, who do you expect to have access to this URL? They're not as visible as you think they are. This entire thing just sounds weird without more context. Please be detailed as you can in your question.
    – sfdcfox ♦
    Commented Dec 1, 2021 at 21:38

1 Answer 1

Reset to default
5

This console is accessed by our business team to work with customer cases. As we are including all data in the URL, I am trying to implement encryption on one of the URL parameters that holds customer's PI data. I would need encryption to hide the customer's PI data from our business users. The child aura component(s) render only few fields from this PI data. And the reminder of the data is still useful, but for different components.

Nope, nope, nope. Any data sent to the client can be accessed by the client, full stop - they have control over the local browser and hardware. This design needs to be rethought. Only the information the end user is permitted to see should be transmitted to the client, ever. If you're working in a regulated industry, this implementation could end up costing your company a lot of money or have other legal implications.

Additionally, PII should not be stored in the URL, encrypted or otherwise. Use a different strategy to share data between components, respecting the Principle of Least Privilege (exactly as much access as is required, and no more).

Improve this answer
2
  • I see where you are going with this. I will definitely convey your context to our internal team. Thanks. But, I am still wondering on my actual question - Can we do the encryption within Aura comp? If yes, what could be the approach? Just curious to know even if its possible.
    – Austin Evans
    Commented Dec 1, 2021 at 23:11
  • 2
    It's possible, but it's completely insecure against the local user. Unless you're trying to implement end-to-end encryption of user data, where your system never holds the keys but the user does, it is a waste of time. There are many JavaScript cryptography libraries but I'm not expert in that ecosystem and can't recommend one specifically.
    – David Reed
    Commented Dec 1, 2021 at 23:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .