Hiding browser data

[Tarby777]

G'day folks,

Sorry for going OT... this isn't Webspeed-related but there is a Progress app and a web browser involved, so here seems as good a place to ask as anywhere...

I have some apps running in the Chrome browser, with the front-end developed in Sencha and a 10.2B database on the back-end, via the WSA. The Chrome developer tools are very useful in showing me how long calls are taking, which services are being invoked and so on, but they also present a security hole. I appreciate that I can encrypt passwords etc but I'm wondering whether I can easily hide the whole session from the developer tools and similar utilities, to prevent others from snooping on the data. SSL would encrypt the traffic between the client and the web server, but would it still be visible to someone using the browser tools on the client itself?

TIA
Tarby

 

[Tarby777]

Turns out that with an SSL connection, the Chrome tools show the data to the user before it is encrypted...

 

[TomBascom]

Isn't it sort of fundamental that anything the browser can see can, ultimately, be seen by the user if they try hard enough?

 

[lee.bourne]

I agree with Tom. If you feel that the information within the browser presents a security threat then you need to rethink the architecture of your application so that sensitive data never makes it to the browser. You can't rely on SSL to do the encryption because as you have found out, that just secures the data as it travels across the network. Even if you encrypt your data before sending it then chances are that the method you use to decrypt it on the browser side is also available to the user if they really want to work out how to decrypt it.

Lee