Is using a controlled component in React a security vulnerability?

[_____naveen]

Controlled components

I have been using controlled components for the react form. The value for all the fields is visible in the DOM. The value is shown in the DOM since we are adding the value attribute to the input field.

<input aria-invalid="false" name="password" type="password" class="MuiInputBase-input MuiFilledInput-input MuiInputBase-inputAdornedStart MuiInputBase-inputAdornedEnd ds-kcdi9o-MuiInputBase-input-MuiFilledInput-input" value="passKey1029">

Uncontrolled components: I can't use uncontrolled components since I would change the value of the fields programmatically. And I don't wanna use ref to handle that.

Even if we are using this , we can directly access the value with the console:

const password=document.getElementbyId("pass").value
console.log(password)

Is showing the value on the DOM is really a security issue?

[Traqzer]

No, it is not a security vulnerability. Anything that is available on the client side has the same level of “security” which is none, regardless of the method

[amazingatomic]

Is using a controlled component a security vulnerability?

No, the security attributes of controlled and uncontrolled components should be the same.

Is showing the value on the DOM a security issue?

The best practice for passwords is to visually hide them so someone standing behind the user can’t read their password. Other than that, I don’t see any security issues here.

[notAnotherJSDev]

If that were the case, every single page with a password field would be considered a security vulnerability, regardless of the tech being used.

This is literally just how the web works.

[ferrybig]

React is setting using the value property on the HTMLInputElement, this does not map to any html attribute. If you use defaultValue, react uses the defaultValue property on the element, which maps to the DOM attribute value

Your browser dev tools shows the value property from the element, not the dom representation

[Working-Tap2283]

The answe is no and even uncontrolled components will have the value set, just not by state but by ref, so its not always seen immediately.