search

laravel-zero / laravel-zero

A PHP framework for console artisans
https://laravel-zero.com
3.7k stars 202 forks source link

API secrets in distributed App #294

Closed paulhennell closed 4 years ago

paulhennell commented 4 years ago

Is there a recommended way to safely work with & include API keys for open-source laravel-zero applications?

Reading the docs it seems if I can make an .ENV with API_KEY tokens, then reference those in the app like laravel. Running build locally will then make a .phar which will work using my keys bundled inside, but anyone wanting to run / build from source would need to provide their own keys in their .env file?

A) Is this correct? B) Is it safe to distribute a phar with keys inside like this or can they be extracted?

Apologies for the possibly basic question, but I want to be clear on this before I make a mistake!

owenvoke commented 4 years ago

I'd recommend not embedding keys inside a PHAR file, because they can be extracted as they are not encrypted. 👍 They are usually compressed (using Gzip, etc.) or signed (using SHA256, etc.), but as far as I know Box doesn't support encrypted storage.

You are correct that the env() helper in a config file will bundle the value when running a build. 👍

Personally I tend to have a command such as <my-app> register <token> that saves the API key to ~/.config/<my-app>/config.yml (or JSON). The Laravel Spark installer has a good example of doing this.

And then have a fallback to an env variable (e.g. MY_API_KEY) if that config value doesn't exist. That way you can set the MY_API_KEY value in your .env when developing.

paulhennell commented 4 years ago

That's what I feared with the phar bundling. Had an idea that involved twitter, but you have to jump through hoops to get keys now, so wondered if I could just provide some in the built version so end users aren't required to get their own - but obviously don't want to leak mine!

Really need to think up less problematic fun little projects 😄

owenvoke commented 4 years ago

Yeah, it's always been a bit of an awkward thing to bundle. 🤔 But having a command to set it is usually quite easy for people. 👍 Is it ok to close this?

If you have any further questions, feel free to ask. (Also just noticed you're a fellow Bristol Dev). 👋

paulhennell commented 4 years ago

Sure, thanks for the advice Owen!