Is it safe to expose hmacHash through requests on frontend?

[jinsley8]

I setup the react in-app notification center in my next.js project but I see that hmacHash is exposed in the network tab. Is this supposed to be exposed?

POST - ttps://api.novu.co/v1/widgets/session/initialize, the payload is:

{
    applicationIdentifier: "abcbdef"
    hmacHash: "90475a9241........af14b82"
    subscriberId: "xyzzzzzz....."
}

I have encryption enabled in my app settings and I've followed this guide: https://docs.novu.co/notification-center/react/react-components/

[michaldziuba03]

I think, yes. Novu checks if hmacHash is subscriberId encrypted with Novu API key, so it needs hmacHash and plain subscriberId.
Actually it just acts as signature.

It works very similar to JWT (actually this is how JWT creates signatures). HmacHash can be exposed to the client you want to authorize.

[michaldziuba03]

It's all about avoiding spoofing. If someone knows subscriberId, cannot produce valid hmacHash without API KEY