GAE GO-HTML模板和数据安全

Question

When displaying a webpage through the use of html templates in Google App Engine Go application, does the passed data and/or raw template ever leave the App Engine, or just the final html output? For example, if I have a class

type Foo struct{
    Public string
    Secret string
}

and a template that only uses {{.Public}} argument, does the {{.Secret}} argument ever leave the App? Similarly, if there is a template that displays some special data if the {{.Secret}} argument is present through the use of {{if .Secret}}...{{end}}, is there any way to access that part of the html in any way when the {{.Secret}} argument is not present?

Answer 1

It's your Go program that parses the template. This can take place on several GAE server instances. Assuming that leaving GAE means being sent over an HTTP/S connection over the public internet, then no - the output you send is the parsed HTML template.

It's not possible to access the part after {{if .Secret}} if it's not included in the final HTML that the client receives.

What you could do, however, would be to send the template and it's associated dataset encoded as gob or JSON over to your client, and let your client parse the template.