search

CrowdStrike / psfalcon

PowerShell for CrowdStrike's OAuth2 APIs
The Unlicense
350 stars 66 forks source link

[ QUESTION ] Client Secret as Secure String #395

Closed swiru95 closed 5 months ago

swiru95 commented 5 months ago

Description of your question Should not Client Secret be treated as SecureString?

To Reproduce REquest-FalconToken etc...

Expected behavior Secure string is quite important credential - should be treated carefully, especially if it comes to EDR access.

Environment (please complete the following information): n/a

Additional context Security good practice and credential leakage prevention - logs, scripts etc.

bk-cs commented 5 months ago

Please see this discussion: https://github.com/CrowdStrike/psfalcon/discussions/101

I recommend using the Microsoft SecretStore module to protect your API client credentials: https://github.com/CrowdStrike/psfalcon/wiki/Authentication#securing-credentials