Hi, i just wanted to know what is the best way of ...

# kilua

[Sunil Kumar]

Hi, i just wanted to know what is the best way of using secrets via environment variables in kilua. I tried to use buildkonfig, but that is not working properly, it generating empty BuildKonfig file in build/buildkonfig/commonMain and not picking up the the fields which i added there in config in build.gradle, and even that empty BuildKonfig file is also not importable in webMain. Its showing unresolved reference.
I am wondering if we have any other way of using environment variables in kilua?

[Robert Jaros]

Hello.

[Robert Jaros]

What's your goal? Do you create a frontend only application?

[Sunil Kumar]

Its SSR based, it will have backend api as well, but i am trying to use firebase in frontend.

[Robert Jaros]

So any secrets keys will be exposed in public code anyway, am I right?

[Robert Jaros]

In general, Kilua apps are build with webpack, so you can use webpack plugins https://webpack.js.org/plugins/environment-plugin/

[Robert Jaros]

Value defined with these plugins can be read in the application code using simple external val

[Robert Jaros]

But I don't think this will help you protect any api keys, when all frontend code is just published as JS or Wasm code in the browser (and you can always just debug network calls with browser dev tools)

[Sunil Kumar]

Yes, i think you are right on this, keys will be eventually exposed via js bundle, its kind of similar to android app bundle. Anyway i will try this plugin atleast to not expose the keys in git and read via env variables.
So generally we can secure them only if implement at backend side, But If you have any other idea of securing the keys, then you can suggest.

[Sunil Kumar]

But i dont think we have any other idea to hide keys from frontend, right?
SO in your opinion, whats the best way of integrating google signin via firebase in kilua?

[Robert Jaros]

The problem is well known in the web community. Just search for some articles about React (like this one: https://cybersierra.co/blog/secure-api-keys-react/) and you will get some suggestions.

[Robert Jaros]

I can't help you more, because I've never used firebase and I mostly develop fullstack apps (with full spring boot backend).

[Robert Jaros]

BTW I'm planning new release this weekend, so you might want to wait a bit with launching your app.

[Sunil Kumar]

Ok thanks for the suggestion.
And yes The launch will be delayed automatically i guess by one or two weeks becoz i need to settle all these things authentication and other.