Sitecore react jss form POST call expose sc_apikey on url

Question

Does someone know why Sitecore expose your API_KEY with jss forms. Create a simple form, open chrome dev tools (network tab) and click submit.

You will see something like this:

http://localhost:3000/api/jss/formbuilder?fxb.FormItemId=207146f1-9c73-408c-94f0-c6b3d9ae18fa&fxb.HtmlPrefix=fxb.36b3f201-5cee-4e7c-a812-6432e7ee4a88&sc_apikey={your_producion_key}&sc_itemid=65675a00-6f7a-4dc5-971e-943ca1aab455&sc_lang=en

where {your_producion_key} is the value store in your environments variables .env SITECORE_API_KEY=.

Answer 1

I assume that you are using the Sitecore CMS to build the PUBLIC facing website and in this case if anyone track the API key via browser then they will be able to see only known content which available publicly.

Other option is to add proxy and don’t expose actual url of call with api key