# Secret Text Plugin

**URL:** <https://meta.discourse.org/t/secret-text-plugin/61615>\
**Category:** Development\
**Created:** [April 26, 2017, 2:58am UTC](https://meta.discourse.org/t/secret-text-plugin/61615 "2017-04-26T02:58:43Z")\
**Posts on this page:** 1\
**Showing post:** 6

<div class="post-metadata">

**Author:** ![gdpelican](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/gdpelican/32/81308_2.png) [@gdpelican](https://meta.discourse.org/u/gdpelican)\
**Post date:** [April 27, 2017, 4:35pm UTC](https://meta.discourse.org/t/secret-text-plugin/61615/6 "2017-04-27T16:35:28Z")

</div>

I don’t think middleware rendering would be the answer here; the cooked post is stored in the database and serialized out over API, so your options begin basically at the serializer (`post_serializer.rb`) on the way out.

Two potential options:

- **server side** : The serializer knows the current user and could manipulate `cooked` as it leaves the server. Problems, though: this strikes me as _slow as hell_, since it’ll have to perform a search-and-possible-replace through every chunk of text that’s getting serialized, which is a lot. It also gets really hairy for live updating, since in that case you’re serializing posts, but you don’t know who they’re going to.

- **client side** : When cooking the post, you introduce a `secret` tag with username attributes, which get deleted from the markup upon hitting the server.

```plaintext
<p data-secret data-reveal-user1 data-reveal-user2>Some secret text</p>

```

```plaintext
# At some point after the post is rendered, I guess?
$('[data-secret]').not(`[data-reveal-${Discourse.User.current().username}]`).remove()

```

Unfortunately, someone who’s a bit savvy could still see the cooked text as it comes over in the network request.

---

_[View the full topic](https://meta.discourse.org/t/secret-text-plugin/61615)._