Question

Is it dangerous to have a plain text credentials.js or should you encrypt it?

Answer 1

If you mean to ask whether storing the user credentials as plain text in a javascript file is dangerous, the answer is a BIG YES. There are plenty of reasons behind it.

• The attackers can directly access the javascript files. So when there are credentials stored as plain texts, there are more possibilities to steal the information such as sensitive information from database like Bank Account Information, Debit/Credit card information,etc.,
• The next important point to be noted is the javascript code will be visible to the users as plain text. So when we have passwords stored in javascript as plain text, it will also be visible to the outsiders which will impact the security and makes the website/application vulnerable.
• Also when the passwords are stored as plain texts it can be easily exposed to others when the user works in a shared environment.

So the direct answer to the question is We should not store the credentials as plain text. So what should we do then? The answer is the credentials should be encrypted and stored in the javascript files. It should be decrypted only when it requested from the browser so that it will not be exposed to the outsiders. It will also improves the security of the website/application.