8000 [security] Secret should not be stored in environment variables · Issue #50 · symfony/flex · GitHub
[go: up one dir, main page]
Skip to content

[security] Secret should not be stored in environment variables #50

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
dunglas opened this issue Apr 22, 2017 · 6 comments
Closed

[security] Secret should not be stored in environment variables #50

dunglas opened this issue Apr 22, 2017 · 6 comments

Comments

@dunglas
Copy link
Member
dunglas commented Apr 22, 2017 •
edited
Loading

Secrets such as passwords and SSH keys must not be stored in environment variables. Basically, environment variables are often stored (unencrypted) in logs and displayed when an error occurs.
The Docker security team recently published a post explaining why storing secrets in env variables should be avoided: https://diogomonica.com/2017/03/27/why-you-shouldnt-use-env-variables-for-secret-data/
They also released a tool to manage secrets.

Flex actually uses environment variables to store secrets (ex: the Doctrine recipe). It should use files or a system similar to the one introduced by Docker instead.
@stof
Copy link
Member
stof commented Apr 27, 2017

Using env variables is still the way things work on all PaaS platforms though.

@mahono
Copy link
mahono commented May 2, 2017

Maybe solve it by referencing a file in an env variable?

@dkarlovi
Copy link

This has been discussed in symfony/recipes#64 too.

@dunglas
Copy link
Member Author
dunglas commented Jun 28, 2017

And here: symfony/recipes#89 (comment)

I'm working on a patch for the DI component, but I've no ETA yet.

@dkarlovi
Copy link

@dunglas excellent, great to see someone with leverage push this issue further. 👍

@dunglas dunglas mentioned this issue Jul 22, 2017
Closed
@fabpot
Copy link
Member
fabpot commented Jul 25, 2017

Closing this one as discussion is now happening on symfony/symfony

@fabpot fabpot closed this as completed Jul 25, 2017
@marfillaster marfillaster mentioned this issue Jul 26, 2017
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
5 participants
@fabpot @dunglas @mahono @dkarlovi @stof
0