codeforequity-at / botium-bindings

The Selenium for Chatbots
http://www.botium.at
MIT License
108 stars 33 forks source link

json configuration files should be renamed to default.json #85

Closed juananpe closed 6 years ago

juananpe commented 6 years ago

Please, correct me if I am wrong. Json configuration files like samples/fbdirect/testmybot.json (files that include credentials, in general) should be renamed to something like testmybot.default.json in order to inadvertently push them to Github. In fact, /testmybot.default.json from root directory is already following this pattern.

codeforequity-at commented 6 years ago

It is generally not a good idea to store secret credentials in a configuration file pushed to anywhere. That's why Botium supports setting configuration by using environment variables.

juananpe commented 6 years ago

Yes, I know, that's why I'm encouraging to not use testmybot.json files. New users (like me) will see that file neatly prepared for writing there their credentials and will proceed ahead. The testmybot.json file is already under Git's version control and if the user pushes the changes, they can inadvertently upload their credentials. This security concern could be easily fixed just by adding testmybot.json to .gitignore and renaming this file to testmybot.default.json in tmb's Git repo. Just my 2 cents :)

codeforequity-at commented 6 years ago

another idea, to make it more visible to use environment variables:

  1. remove the FB_PASSWORD setting from testmybot.json
  2. change the "test" npm script in package.json to something like FB_PASSWORD=#enter your password here# jasmine (or add the cross-env npm module to make it environment independent)
codeforequity-at commented 6 years ago

Enhanced with build 1.4.3