reactjs中的解密密钥存储在哪里？

Question

I am working on react app which fetches the API on the user responses. API response are encrypted and I get decryption key before making any API (via secure method).

I need to store the decryption key so that I can decrypt the API response every single time. Currently I store the decryption key in component state. which can be seen very easily by anyone using react-dev tool

I don't need to store the decryption locally, it changes very time user login.

Answer 1

The key needs to be stored inside an httpOnly cookie, a special kind of cookie that's only sent in HTTP requests to the server, and it's never accessible (both for reading or writing) from JavaScript running in the browser.

By the way, this is the way JWT token verification works as well. So you can use the same mechanism.

PS: Ignore my previous comment, I was just trying to give you an alternative without giving my thought to it

Answer 2

I think you can use Cookies for storing your decryption key, but now that's your choice that you need to persist the cookie or make it available for the session.

You can encyrpt cookies making use of cookie-encryption

Hope this helps!!