Potential security issue with using variables on the window object

[georgiosApo]

There might be issues with specifying variables on the window object.

A hypothetical scenario:

Auth should be required/not required in specific environments.

Consider an env-variable requiresAuth: boolean.

If specified in runtime on the window object, a user could easily manipulate this one from the client.

Or am I missing something?

Cheers!

[tej-rana]

I think the way to do this is to expose an endpoint in nginx the client can call.