MetaMask / MetaMask/api-playground

Prevent addresses from being added to the URLs

Open
#90 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
TypeScript
Stars
7
Forks
8
PR merge metrics
No merged PRs in 30d

Description

Though the playground isn't intended for use with sensitive information, we should still avoid including addresses in URLs to avoid any privacy risks.

The recent addition of analytics that are including URLs in the event parameters exacerbates this risk so it should be prioritized.

Here's an example of what's being passed when there are params included in the URL (there is some masking but that is from a third-party UI and doesn't mean they don't have the full address in their system):
```
analytics.page({
path: '/wallet/reference/wallet_requestpermissions/',
referrer: '',
search: '?requestPermissionsObject[eth_accounts][account]=0***',
title: 'MetaMask developer documentation',
url: 'https://docs.metamask.io/wallet/reference/wallet_requestpermissions/?requestPermissionsObject[eth_accounts][account]=0***'
});
```

At the same time, we want to balance privacy against the developer experience.
@BelfordZ recommends adding a "Copy" button to allow developers to save their input data from the playground in case they need it again later.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by reproducing the analytics.page payload shown in the issue from the playground, then trace how input parameters become URL search data. Review the privacy concern alongside the proposed Copy button and define the desired behavior before implementation. Done means addresses are not exposed through URLs or analytics while developers can still preserve their input.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript
Domain
security, web-dev
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.