Secure mode

Overview

This topic explains how to use the secure mode feature to safely evaluate feature flags in your web browser.

Using secure mode

Secure mode ensures that users' feature flag evaluations are kept private in web browser environments, and that one user cannot inspect the variations for another user. On an insecure device, a malicious user could use a user key to identify what flag values a user receives by analyzing the results of multiple flag evaluations. Secure mode prevents you from doing an evaluation for a user key that hasn't been signed on the backend.

Secure mode is only available for communication between client-side SDKs and LaunchDarkly. It is not necessary for server-side SDKs.

Understanding how secure mode works

Secure mode works by having you configure your JavaScript SDK to include a server-generated HMAC SHA256 hash of your user key. This hash is signed with the SDK key for your environment.

To use secure mode, you must complete the following:

• Enable secure mode for each environment. You can enable secure mode for each of your environments on the Environments tab of your project under Account settings page. Secure mode is an environment-wide setting. You can enable secure mode for your environment even if you're also using mobile SDKs that don't support it. Enabling secure mode does not cause those SDKs to fail.

• Compute the secure mode hash. Enabling secure mode means that every request coming from a client-side JavaScript SDK requires the secure mode hash to evaluate flag variations. You can pass this to your front-end code with the mechanism of your choice, such as bootstrapping or as a template variable.

  Each of our server-side SDKs includes a method to compute the secure mode hash for a user. To learn how, read Generating a secure mode hash. Alternatively, you can compute the hash yourself. To learn how, read Computing the hash manually.

• Send the computed secure mode hash for your user. You need to include this when requesting flag evaluations. To learn how, read Configuring secure mode in the JavaScript client-side SDK.

Generating a secure mode hash

You can use the following server-side SDKs to generate a secure mode hash:

• .NET (server-side)
• Go
• Java
• Node.js (server-side)
• PHP
• Python
• Ruby
• Rust

.NET (server-side)

var hash = client.SecureModeHash(user);
COPY

Go

client.SecureModeHash(user)
COPY

Java

client.secureModeHash(user);
COPY

Node.js (server-side)

client.secureModeHash(user);
COPY

PHP

$client->secureModeHash(user);
COPY

Python

hash = ldclient.get().secure_mode_hash(user)
COPY

Ruby

client.secure_mode_hash(user)
COPY

Rust

client.secure_mode_hash(&user);
COPY

Computing the hash manually

To compute the hash manually, locate the server-side SDK key for your environment on the Environments tab of your project under the Account settings page. Then, compute an HMAC SHA256 hash of the UTF-8 encoding of your user key, using the UTF-8 encoding of your SDK key as a secret, and convert the hash to a hexadecimal string.

Here is a .NET (server-side) example:

using System;
using System.Security.Cryptography;
using System.Text;
var encoding = new UTF8Encoding();
var keyBytes = encoding.GetBytes("YOUR_SDK_KEY");
var hmacSha256 = new HMACSHA256(keyBytes);
var hashBytes = hmacSha256.ComputeHash(encoding.GetBytes("YOUR_USER_KEY"));
var hashString = BitConverter.ToString(hashBytes).Replace("-", "").ToLower();
COPY

Configuring secure mode in the JavaScript client-side SDK

You should send the computed secure mode hash for your user as the hash attribute in the LDOptions object during client initialization and as the hash parameter if subsequently identifying new user contexts:

// client initialization
const client = LDClient.initialize('YOUR_CLIENT_SIDE_ID', user, options = {
  hash: 'SERVER_GENERATED_HASH'
});
// identification of new user contexts
client.identify(newUser, hash, function() {
  console.log("New user's flags available");
});
COPY

To use secure mode, user objects must contain a predefined key attribute. Secure mode is not compatible with the SDK's ability to automatically generate user keys for anonymous users because the SDK needs a correctly calculated hash value.