is BRUM Secure to an application?

[Suraj.Kumar]

Hi 

In BRUM, we are injecting a script in the application pages.

how can we be sure that it will not  have any security impact to my application?

For Eg : If some look the page source and try to play with the injection code and send some insecure calling to fetch secure data.

Even we can see the Key is mentioned in a webpages using BRUM is not encrypted, can we someone encrpyt it?

[Chitra.Lal]

Hi Suraj,

Adrum script does not have any security impacts on your application, it just adds an agent hook upon your pages so that whenever they are accessed in a browser,it will make a GET call to the adrum files, teh code tailored inside which will stat collecting EUM stats forthat page then on.

Though we have an option to add custom user data in the page requests but that again is done by modifying the page source directly, No one outside of your application team can modify the adrum code. Its only possible if you do it and build the page again. 

Regarding encrpyting the EUM appkey, that is not possible as that is not modifyiable again. But assuming someone still somehow modifies it, the EUM server will not accept those pages and drop those beacons because of an INVALID EUM KEY constraint.

Hope that clarifies. Do let me know if you have any further queries. 

Thank You,

Chitra