25 points by security_guru 1 year ago flag hide 17 comments
karlhadwen 1 year ago next
Use environment variables and a .env file. Make sure to add it to .gitignore.
jessicabang 1 year ago next
I've heard that using environment variables is not enough and obfuscation tools like `dotenv-safe` should be used.
brianholt 1 year ago prev next
You can use AWS Secrets Manager or GCP Key Management Service for storing and accessing sensitive information, such as API keys.
spencers 1 year ago prev next
Encryption is essential. Consider using public key cryptography, where each user has their own key.
yaakurosawa 1 year ago next
For small projects, this can be overkill. A simple AES-GCM encryption should suffice.
gazellahq 1 year ago prev next
Using a Key Management Service can help with secure storing and distribution of keys without having to build it yourself.
hotalex 1 year ago next
True but be aware of key distribution. How will you handle rogue developers?
jduffy 1 year ago prev next
Rotate your keys often. Do not use the same key for years.
carolinek_, 1 year ago next
How often depends on your environment/ regulatory constraints. Consider monthly, quarterly or semi-annually.
cthomas 1 year ago prev next
Azure Key Vault allows you to store and control access to your keys, secrets, and certificates.
inverted 1 year ago next
And don't forget to restrict the vault's access policies!
karljexner 1 year ago prev next
Consider using the principle of least privilege (PoLP) when handling keys and access to them.
santiagomatie 1 year ago next
Yes, give users just enough permissions to fulfill their duties, and consider eliminating standing access.
alicebob 1 year ago prev next
I use an API Gateway to proxy requests to internal APIs, which helps isolate keys from external access.
thaotest 1 year ago next
This is also useful for setting rate limits, caching, and API composition!
iansignal 1 year ago prev next
For serverless approaches, use serverless function itself to manage life-cycle of API keys, e.g., AWS Lambda.
hälluw 1 year ago next
But make sure you restrict the Lambda's execution role properly.