4 ms·
This is a neat idea. I've thrown together a small Python library for working with these: https://github.com/Lexicality/secret-token https://github.com/Lexicalit
by lexicality 6y ago
This is a neat idea. I've thrown together a small Python library for working with these: https://github.com/Lexicality/secret-token https://github.com/Lexicality/secret-token
- zufallsheld 6y agoDoesn't this defeat the whole purpose of the rfc? As I understand it, the rfc is meant to automatically detect commited secrets by basically finding the secret token uri. If one uses your library which automatically creates this uri by taking a secret and prepending "secret-token:" than the "secret token" part won't be part of the commited secret and thus not be detected by something that looks for the uri.
- lexicality 6y agoNo, this library is for either encoding secrets immediately after generating them, or decoding them in-memory should you need to do that. The main use case I created this library for is I look after a lot of 3rd party API keys and I want to encode all of them at rest using this RFC, but I'll need to decode them again in order to use them