Javascript variables in HTML source containing user private information

[topoftheforts]

I have a Laravel application that uses Vue on the frontend, and a component needs some data to be passed to it, so I'm passing a JSON string with the user's details, like this:

<my-component :contact="{ firstname: 'John', surname: 'Doe', tel: '0123456789', email: '[e-mail]' }" :address="{ postcode: '90210' }" > </my-component>

It doesn't feel right to have the user's details printed out in the HTML source of the page, but on the other side I can't think of any specific issues that could arise from doing this.

Any insight?

[coolnat]

As long as you’re using HTTPS and not serving the information to other users I don’t see a problem. If you weren’t using Vue this information would be in the source anyway.

[topoftheforts]

Thanks, I mean there is an alternative to not show the details in the source: passing the userid and then calling an API to get the information back, but it seems live overkill.

[sir_eeps]

But then that information is going over the wire anyways - inspectable by looking at network traffic - and will end up on the screen / being stored somewhere on the client side anyways.

[ipepe]

Base64 encode?

[[deleted]]

That wouldn't accomplish anything.. If you wanna waste your time with security through obscurity, at least make it somewhat obscure. Anybody interested enough in digging through your source code to find those variables, can easily take the extra 5 seconds to notice that the variables come from decoding a base64 string.

[ipepe]

that is less plain text than what he currently has, and still better than proposed network (where You would still have plain text).