Is it safe to store secrets in op_state?

[glitch003]

Hi, I want to put some data into the op_state in my Rust functions to persist it between JS function calls. But it's vitally important that the JS can't see the data. Is this safe? Is there a way for the JS to see into op_state?

Thanks

[bartlomieju]

It's not possible for any JS function to access this data unless you have a corresponding op that can access it. In such case a call to Deno.core.opSync('op_name') could access this data.

If you provide more context on what you're trying to do we can advise some solution.

[lucacasonato]

Be aware that all data on the same thread (and possibly in the same process) as the V8 isolate is vulnerable to leakage through side channel attacks like Spectre unless very stringent precautions relating to timing accuracy are taken.