A React single-page app for recreation registration embeds a privileged Cognito app client secret and a long-lived AWS access key in the browser bundle. What should the team do?
Select an answer to reveal the explanation.
Short Explanation
Anything in a React bundle is a postcard — the whole internet can read it. Privileged Cognito secrets and AWS keys stay on the server; browsers get public-client OAuth patterns like PKCE.
Full Explanation
Public clients cannot protect confidential client secrets or IAM access keys. Use Cognito public-client flows (for example Authorization Code with PKCE) and never ship AWS long-term keys to browsers; call AWS from authenticated backends or temporary credentials designed for the use case. Encoding, weekly rotation while still embedding, or public hosting do not make client-side privileged secrets safe.