Keeping secrets out of deployments

In the served page, after copy:redact

copy:redact has no effect on deploy. The element and its content are served, and the attribute is kept: the served root writes copy:redact="".

In the source

Appending ? to the route URL opens the deployed source in RTCode.io. It is the complete authored input. It includes the content of edge:redact, edge:remove and copy:redact elements, workers without edge, and every o: and h: attribute. See ?.

In exported files

An element with o: or worker:fs and edge:redact or edge:remove is still exported: its body is extracted before the element is hidden. <template o:=Page.html edge:redact> serves Page.html at its URL and disappears from the root. A file is a public URL unless the edge:user gate protects it.

In versions, the playground URL and File Sync

Every deploy saves the complete source as a version, so removing a value from the source later does not remove it from earlier versions. The playground URL carries the source, and so does File Sync's 📄.html; copy:redact affects neither.

In the playground

In the playground, edge:redact and edge:remove do nothing: the output renders and runs the elements. Code: Size shows a ⚑ count of the elements that are stripped or redacted on deploy.

Keep the source private

When the source is private, only signed-in viewers who are the owner, an editor or an io:user permit (an exact email, a domain, or * for any signed-in user) may open it. A source that is not private can be opened by anyone, without signing in.

See Restricting access for the three attributes.

Keep values in an edge worker

The code of an edge worker is blanked from the served page. Unless the worker carries io:guest, the source that contains it is private. Put values the browser must never see inside the worker, and let the page call the worker through a : URL.

Keep worker assets out of the page

worker:fs alone does not take the element off the page: it stays in the served HTML with the attribute stripped. Add edge:remove or edge:redact to keep it out of the served page. The asset still remains in the deployed source. See worker:fs.

Protect files with edge:user

A deployed file is a public URL. edge:user puts the page and its exported files behind sign-in. Redacting the element that exports a file does not.

A private worker holds the values

The page asks the worker whether a code is valid. The list of valid codes stays inside the worker and is never sent to the browser:

<script type=worker edge>
  const codes = ['replace-me', 'replace-me-too']  // stays in the worker
  export default { fetch: request => Response.json({ ok: codes.includes(new URL(request.url).searchParams.get('code')) }) }
</script>
<input id=pin placeholder=code> <button id=go>Check</button> <output id=answer></output>
<script type=module>
  go.onclick = async () => answer.value = (await fetch(`:check?code=${pin.value}`).then(r => r.json())).ok ? 'valid' : 'invalid'
</script>

The worker has no io:guest, so deploying it makes the source private to you, your editors and any io:user permits.

Three kinds of redaction

This input uses all three attributes:

<div edge:remove>Local notes</div>
<script edge:redact>
  console.log("playground-only diagnostics")
</script>
<script copy:redact>const demoKey = "not-for-clipboards"</script>

All three elements render or run in the playground.

The served page

On RTEdge.net, the served page has an empty first line where the <div> was, then a three-line comment where the script was, then the script with copy:redact kept:

<!--REDACTED

-->
<script copy:redact="">const demoKey = "not-for-clipboards"</script>

Copying the third element from the editor yields <!--REDACTED-->. The deployed source, opened with ?, still contains all three elements.