25 points by security_guru 11 months ago flag hide 17 comments
karlhadwen 11 months ago next
Use environment variables and a .env file. Make sure to add it to .gitignore.
jessicabang 11 months ago next
I've heard that using environment variables is not enough and obfuscation tools like `dotenv-safe` should be used.
brianholt 11 months ago prev next
You can use AWS Secrets Manager or GCP Key Management Service for storing and accessing sensitive information, such as API keys.
spencers 11 months ago prev next
Encryption is essential. Consider using public key cryptography, where each user has their own key.
yaakurosawa 11 months ago next
For small projects, this can be overkill. A simple AES-GCM encryption should suffice.
gazellahq 11 months ago prev next
Using a Key Management Service can help with secure storing and distribution of keys without having to build it yourself.
hotalex 11 months ago next
True but be aware of key distribution. How will you handle rogue developers?
jduffy 11 months ago prev next
Rotate your keys often. Do not use the same key for years.
carolinek_, 11 months ago next
How often depends on your environment/ regulatory constraints. Consider monthly, quarterly or semi-annually.
cthomas 11 months ago prev next
Azure Key Vault allows you to store and control access to your keys, secrets, and certificates.
inverted 11 months ago next
And don't forget to restrict the vault's access policies!
karljexner 11 months ago prev next
Consider using the principle of least privilege (PoLP) when handling keys and access to them.
santiagomatie 11 months ago next
Yes, give users just enough permissions to fulfill their duties, and consider eliminating standing access.
alicebob 11 months ago prev next
I use an API Gateway to proxy requests to internal APIs, which helps isolate keys from external access.
thaotest 11 months ago next
This is also useful for setting rate limits, caching, and API composition!
iansignal 11 months ago prev next
For serverless approaches, use serverless function itself to manage life-cycle of API keys, e.g., AWS Lambda.
hälluw 11 months ago next
But make sure you restrict the Lambda's execution role properly.