JRoss078899 (Community Member) asked a question.
CWE 200 Information Exposure
All,
I have an Angular web app that is hosted in Azure App Services. We have an appSetttings.json which has some configuration settings that Veracode is complaining that they can make a HTTP GET call to see the values. I'm trying to think of a way to allow the web app to grab these values, but prevent an HTTP GET call from the browser. Can anyone think of a way to do this? I was hoping I didn't need to move the config to the server-side. Maybe there's some web.config setting(s), masking, encryption, etc I could do? Thanks in advance.
.png){kind=logo}
Hi @JRoss078899 (Community Member) ,
The `appSettings.json` file may hold sensitive values, if it does not currently it may do so in the future when you forget it has been made directly available to the Web.
Instead, we'd recommend having a separate manually managed file with settings specifically intended for the public web client, something like `public-settings.json`.
Thank you,
Boy Baukema