Do not use secrets in environment variables

#1

Post by dangtony98 » Mon, Oct 07, 2024, 5:25 PM UTC

Do not use secrets in environment variables
nodejs-security.com

Re: Do not use secrets in environment variables

#2

Post by Circlecrypto2 » Mon, Oct 07, 2024, 5:31 PM UTC

I actually liked this article. A great explainer in why environment variables are a terrible idea. Nike actually open-sourced their Keystore solution if anyone is curious. It was called cerberus.

Re: Do not use secrets in environment variables

#3

Post by liveoneggs » Mon, Oct 07, 2024, 5:47 PM UTC

this is mostly about not using .env files

Re: Do not use secrets in environment variables

#4

Post by moritonal » Mon, Oct 07, 2024, 5:52 PM UTC

Circlecrypto2 wrote: post #2

I actually liked this article. A great explainer in why environment variables are a terrible idea. Nike actually open-sourced their Keystore solution if anyone is curious. It was called cerberus.

TIL Nike (the shoe company) has a surprisingly intense OSS presence.

https://github.com/orgs/Nike-Inc/repositories

Re: Do not use secrets in environment variables

#5

Post by adhamsalama » Mon, Oct 07, 2024, 5:55 PM UTC

moritonal wrote: post #4

Circlecrypto2 wrote: post #2

I actually liked this article. A great explainer in why environment variables are a terrible idea. Nike actually open-sourced their Keystore solution if anyone is curious. It was called cerberus.

TIL Nike (the shoe company) has a surprisingly intense OSS presence. https://github.com/orgs/Nike-Inc/repositories

> hal provides an AWS Lambda Custom Runtime environment for your Haskell applications.

Didn't expect that from Nike.

Re: Do not use secrets in environment variables

#6

Post by zemo » Mon, Oct 07, 2024, 5:59 PM UTC

moritonal wrote: post #4

Circlecrypto2 wrote: post #2

I actually liked this article. A great explainer in why environment variables are a terrible idea. Nike actually open-sourced their Keystore solution if anyone is curious. It was called cerberus.

TIL Nike (the shoe company) has a surprisingly intense OSS presence. https://github.com/orgs/Nike-Inc/repositories

> Nike (the shoe company)

as opposed to Nike, the Ancient Greek goddess of Victory, who contributes essentially nothing back to the OSS community

Re: Do not use secrets in environment variables

#7

Post by spankalee » Mon, Oct 07, 2024, 6:00 PM UTC

In what world does this work?

    $ curl http://your-website.com/public/../../../../proc/12345/environ

If your server is serving up your whole filesystem, you likely have a lot of big problems.

Re: Do not use secrets in environment variables

#8

Post by cartofupai » Mon, Oct 07, 2024, 6:00 PM UTC

“Even if exposed or leaked, it is one secret to rotate rather than all of your secrets, scattered across all of your services and their environment variables.”

I don’t think this is true. You’d rotate all secrets in the store, as they could be accessed/compromised.

Re: Do not use secrets in environment variables

#9

Post by diggan » Mon, Oct 07, 2024, 6:04 PM UTC

liveoneggs wrote: post #3

this is mostly about not using .env files

I'm not sure if I understood something wrong, but .env files are for development, not production. It never crossed my mind to use .env files for production deployments, but skimming the blog post, it seems like people do ship a .env file to their production environment?

Re: Do not use secrets in environment variables

#10

Post by jonathanlydall » Mon, Oct 07, 2024, 6:06 PM UTC

liveoneggs wrote: post #3

this is mostly about not using .env files

Yes, not so much about environment variables which can be injected by your hosting environment which as far as I know shouldn’t really be an issue (assuming your hosting environment sources them securely).