API Keys saved in clear in the database #1
Assignees
Labels
backend
Pull requests that update Go code
Comments
loleg
pushed a commit
that referenced
this issue
Nov 4, 2021
…problem (#229) * Fix email from mismatch between env and settings db (#175) * Encrypt Infura and SparkPost API keys inside the databse (#1) * updated websocket package version to solve the go sum checksum mismatch problem * Add golang.org/x/tools to go.sum by go mod download * Modify dependencies to fix go.sum * Modify go.sum * Modify go.sum * Modify go.sum * Fix tests dependency problem * Add encryption secret key to the Makefile * change the encryption secret key in makefile
loleg
added a commit
that referenced
this issue
Nov 4, 2021
* Refactored start docs * Changed source of go-bindata #197 * Updated go dep trackers * Updated yarn dependencies * Added update step to Makefile * New auto-generated bindata tests * Added doc note about make update * yarn upgrade * Doc: rename Infura key as "project ID" for clarity * Set resource class to medium for CircleCI builds * Use Debian 'stable' release in Docker * Add .env configuration loader to make #204 * Copy env during bootstrap * Documentation related to license finder * go-bindata install path * Docker documentation link * README revised * Added logging instruction * Revert go-ethereum v1.9.25 * Detect window.ethereum (#203) * mod clean * Updated minor go dependencies * Fix email from mismatch between env and settings db (#175) * Encrypt Infura and SparkPost API keys inside the databse (#1) * updated websocket package version to solve the go sum checksum mismatch problem * Add golang.org/x/tools to go.sum by go mod download * Modify dependencies to fix go.sum * Modify go.sum * Modify go.sum * Modify go.sum * Fix tests dependency problem * Add encryption secret key to the Makefile * Fix go mod tools loading and pin fasthttp/websocket version * go.sum check * Added documentation on PROXEUS_ENCRYPTION_SECRET_KEY Co-authored-by: Mehdy javany <[email protected]> Co-authored-by: javany <[email protected]>
loleg
changed the title
loleg
added
backend
loleg
added a commit
to loleg/proxeus-core
that referenced
this issue
Apr 4, 2022
tafonina
pushed a commit
that referenced
this issue
Jun 9, 2023
Preprod from Main github merge to develop fork
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
API Keys are currently saved in clear when configuring the Proxeus server. Instead, like modern Cloud Native applications, these keys should not be saved in the database at all. They should not need to be edited by system administrators on the fly.
It is in any case right now necessary to restart the application to apply changes to the keys. This should be made clear in the documentation.
Steps to reproduce
Go to configuration settings and edit the API keys to remote services.
Expected behaviour
Configuration keys are stored only in configuration files (.env or .yml), loaded on startup. They are not stored in the database.
Actual behaviour
It is not encrypted in the database, and shown in plain text to administrators, both are security risks.
The text was updated successfully, but these errors were encountered: