Set up some form of authentication for the Discovery editor

[nerik]

The discovery editor, in its current form, is unsafe to be deployed. While it won't make it to production as part of the sandbox, our staging environment is not password protected. And this editor could in theory be used for a code injection based attack.

My hunch is that trying to sanitize the user's input is a fools errand, so we could decide to either

• password-protect staging (https://docs.netlify.com/visitor-access/site-protection/). Probably with basic auth, since Netlify team login will cost us extra seats.
• password-protect the Discovery editor route with basic auth https://docs.netlify.com/visitor-access/basic-authentication-with-custom-http-headers/.
• use a more robust form of access control, which would require a backend solution.

Of course this relies on this assumption that a limited number of reliable people have access or knowledge of the credentials, and we deem that sufficient as a protection measure.

Thoughts @hanbyul-here @danielfdsilva ?

[nerik]

TBH I'm a little surprised the MDX playground itself is using eval... And allows cross-scripting in theory

[danielfdsilva]

Password protecting staging is easy and we could do it without a problem.

I wonder if the single route protection works given that this is a SPA (no server route request), and not directory based routing.

Nevertheless, I would not be too worried about security at this point. The code will always remain on the client side, so any "malicious" code that the user writes will only affect them. Only once the code gets stored and sent to other users, there's the possibility of arbitrarily executing code.

[nerik]

Got it, thanks.

[hanbyul-here]

Yeah. It still gives me cold feet that that user can run whatever script, but I can't think of a case where this can be a big security problem as long as the executable code lives only on the client side.

[danielfdsilva]

As of current implementation, no security issues with the editor itself and the envs are password protected by netlify. Closing.