darrenburns / posting

The modern API client that lives in your terminal.
Apache License 2.0
4.48k stars 64 forks source link

Support for encrypting/decrypting passwords for BasicAuth #80

Open sczsh opened 1 month ago

sczsh commented 1 month ago

Hi,

I'd like to propose a feature, which lets the user set a master password via ENV variable, which is then used to encrypt/decrypt the password field in the *.posting.yaml file

Current situation for a *.posting.yaml file

name: Get Player 
description: Gets a player by id
url: https://localhost:8080/player/4
auth:
  type: basic
  basic:
    username: test
    password: test
headers:
- name: Content-Type
  value: application/json

Proposed change:

name: Get Player
description: Gets a player by id
url: https://localhost:8080/player/4
auth:
  type: basic
  basic:
    username: test
    enc_password: U2FsdGVkX18UCL1XW/Xxg7oyj7sBlg8p0ot+f3rW6Lc=
headers:
- name: Content-Type
  value: application/json

The example "enc_password" was generated with

echo "test" | openssl enc -e -aes-256-cbc -a -salt -pbkdf2

and "123456" as password.

Reason for this proposal:

Encrypting the BasicAuth credentials would it make easier to share a larger number of collections safely, for example, via VCS without the possibility to accidentaly push the plaintext password. Also then there would be no need to remove the plaintext credentials, before pushing such a collection (or more collections), by hand and have to type them in again after i cloned the repo.

The following steps show how this could work in the application:

If the ENV variable is not set, the default behaveior (no encryption/decryption) will be activated

Thanks for this awesome tool and best regards