3 ms·
In a large Node.js project, I have a file secrets.js, which is full of lines like: exports.passwdHmacKey = 'awaibaeSeingoo4phahjeekee6Ufetev'; Put secrets.js
by tlb 11y ago
In a large Node.js project, I have a file secrets.js, which is full of lines like:
exports.passwdHmacKey = 'awaibaeSeingoo4phahjeekee6Ufetev';
Put secrets.js in .gitignore, and copy it where needed manually.
- tptacek 11y agoThings like this are fine. Big sites sometimes have key management servers, provisioned sort of like Zookeeper is. (Just using your comment to riff now:) As long as you're not (a) checking it into VCS and (b) having every developer hold a copy on their laptop, whatever you're doing is fine. What this site does, though, means that any time someone loses their laptop, or really just leaves their laptop unattended somewhere unsafe, everything needs to be reprovisioned. In fact: if you don't have audit controls (who's used which key when), technically, any time that happens, you need to disclose that it happened to your users. A nightmare.
- ars 11y agoDevelopment and production should not use the same keys! Losing a development laptop should not also lose any important keys. What I do is check in a throwaway key into source control, then modify the file with the real key on production and never check it in. Since you never do checkins from production this works well.
- tptacek 11y agoI agree of course, but in practice, the dev/prod distinction is very unreliable, because people will stand up dev servers that run with dev keys, for which a dev key compromise pivots to a data center (or PII) compromise.