How can I protect json data from "XHR finished loading […]"?

Question

Hello I'm doing a PWA and I use Google spreadsheet to store info and send emails. When I use the app, in the console shows me the "XHR finished loading" message with an url with json data from my entire sheet.

What I want is that people don't have access to that URL or the JSON data, is this possible? or What should I do so that information is not visible in that way?

Answer 1

if your UI can access a URL, anyone could. You can protect it though, deepening on your server side capability. If your server side can authenticate the request to have proper credentials, then the protection can be implemented.

But you can't mask anything from UI to prevent users from seeing it. What goes to browser -> user have visibility. PWA wont change that fact.