search

kblincoe / QualOpt_SE701

2 stars 15 forks source link

Issue: Encrypting Spring Social Client IDs and Secrets #103

Closed st970703 closed 6 years ago

st970703 commented 6 years ago

This issue is related to Issue #24, as well as #22 and #23.

At the moment, all the Spring Social Client IDs and Secrets are exposed as plain strings in 'src/main/resources/config/application.yml'.

As 'TheGuardianWolf' suggested, If these IDs and secrets are committed to a public repository then they are no longer secrets. This issue should investigate alternative means of providing this type of information and how to submit them with integrity, otherwise, those API accesses could be abused.

Depending on the encryption technique used and the complexity of implementing it, I suggest this can be a medium issue. @softeng-701

TheGuardianWolf commented 6 years ago

Normally these are provided locally via environment variables, I suggest merging the issue with #92 and #50 to prompt users to fill them via user input or take them from env.

kblincoe commented 6 years ago

I don't see why this needs to be a separate issue (this is part of the implementation in issue #24). Please fix it there.