Security - how are user authenticated?

[leonardbinet]

Based on https://docs.novu.co/notification-center/getting-started#react-component documentation, for a user to fetch its notifications, we only need to declared the following react component:

import {
  NovuProvider,
  PopoverNotificationCenter,
  NotificationBell,
  IMessage,
} from '@novu/notification-center';

function Header() {
  function onNotificationClick(message: IMessage) {
    // your logic to handle the notification click
    if (message?.cta?.data?.url) {
      window.location.href = message.cta.data.url;
    }
  }

  return (
    <NovuProvider subscriberId={'USER_ID'} applicationIdentifier={'APP_ID_FROM_ADMIN_PANEL'}>
      <PopoverNotificationCenter onNotificationClick={onNotificationClick}>
        {({ unseenCount }) => <NotificationBell unseenCount={unseenCount} />}
      </PopoverNotificationCenter>
    </NovuProvider>
  );
}

Since APP_ID_FROM_ADMIN_PANEL and USER_ID are handled by frontend, they are not secure, I don't see what prevents a user from impersonating another user, using the USER_ID of another user for instance (via a curl).

Am I missing something that authenticates users?

[szbartnik]

You should use HMAC Encryption in your backend:

https://docs.novu.co/notification-center/react/react-components/#hmac-encryption

[leonardbinet]

Thanks, sorry for that I missed it in the documentation !

[jainpawan21]

Thanks @szbartnik for pointing to HMAC.

@leonardbinet let me know if you need more help!