Doesn't appear to be secure about applicationinsights-react-js HOT 3 OPEN

The iKey is not secure, and you don't even have to go the extreme of seeing the payload in the Network tab, as part of initializing the SDK your Javascript code or the initial page will and MUST include it.

There is a nice long thread on this here microsoft/ApplicationInsights-JS#281, but the short answer is that there is no way to secure this value and it is not considered to be a secret.

from applicationinsights-react-js.

@MSNev just be clear you won´t support Azure AD authentication for Application Insights where you add the login credentials to the appInsights.defaultClient as described here in the future:
https://learn.microsoft.com/en-us/azure/azure-monitor/app/azure-ad-authentication?tabs=nodejs#ingestion-http-errors

Or is this only related to backend clients ?

from applicationinsights-react-js.

Correct, we currently have no active plans to implement this from the client side, and yes this is currently designed for "server" (backend) systems ingestion where the keys can be more tightly controlled.

While conceptually it would seem that having "user" AAD credentials passed down would work there would be no way to send any telemetry "until" the user has authenticated, or to securely have any "standard" authentication available from the clients.

from applicationinsights-react-js.