Why is this an issue?
A hard-coded secret has been found in your code. You should quickly list where this secret is used, revoke it, and then change it in every system
that uses it.
Passwords, secrets, and any type of credentials should only be used to authenticate a single entity (a person or a system).
If you allow third parties to authenticate as another system or person, they can impersonate legitimate identities and undermine trust within the
organization.
It does not matter if the impersonation is malicious: In either case, it is a clear breach of trust in the system, as the systems
involved falsely assume that the authenticated entity is who it claims to be.
The consequences can be catastrophic.
Keeping credentials in plain text in a code base is tantamount to sharing that password with anyone who has access to the source code and runtime
servers.
Thus, it is a breach of trust, as these individuals have the ability to impersonate others.
Secret management services are the most efficient tools to store credentials and protect the identities associated with them.
Cloud providers
and on-premise services can be used for this purpose.
If storing credentials in a secret data management service is not possible, follow these guidelines:
- Do not store credentials in a file that an excessive number of people can access.
- For example, not in code, not in a spreadsheet, not on a sticky note, and not on a shared drive.
- Use the production operating system to protect password access control.
- For example, in a file whose permissions are restricted and protected with chmod and chown.
Noncompliant code example
from requests_oauthlib.oauth2_session import OAuth2Session
scope = ['https://www.api.example.com/auth/example.data']
oauth = OAuth2Session(
'example_client_id',
redirect_uri='https://callback.example.com/uri',
scope=scope)
token = oauth.fetch_token(
'https://api.example.com/o/oauth2/token',
client_secret='example_Password') # Noncompliant
data = oauth.get('https://www.api.example.com/oauth2/v1/exampledata')
Compliant solution
Using AWS Secrets Manager:
import boto3
from requests_oauthlib.oauth2_session import OAuth2Session
def get_client_secret():
session = boto3.session.Session()
client = session.client(service_name='secretsmanager', region_name='eu-west-1')
return client.get_secret_value(SecretId='example_oauth_secret_id')
client_secret = get_client_secret()
scope = ['https://www.api.example.com/auth/example.data']
oauth = OAuth2Session(
'example_client_id',
redirect_uri='https://callback.example.com/uri',
scope=scope)
token = oauth.fetch_token(
'https://api.example.com/o/oauth2/token',
client_secret=client_secret)
data = oauth.get('https://www.api.example.com/oauth2/v1/exampledata')
Using Azure Key Vault Secret:
from azure.keyvault.secrets import SecretClient
from azure.identity import DefaultAzureCredential
def get_client_secret():
vault_uri = "https://example.vault.azure.net"
credential = DefaultAzureCredential()
client = SecretClient(vault_url=vault_uri, credential=credential)
return client.get_secret('example_oauth_secret_name')
client_secret = get_client_secret()
scope = ['https://www.api.example.com/auth/example.data']
oauth = OAuth2Session(
'example_client_id',
redirect_uri='https://callback.example.com/uri',
scope=scope)
token = oauth.fetch_token(
'https://api.example.com/o/oauth2/token',
client_secret=client_secret)
data = oauth.get('https://www.api.example.com/oauth2/v1/exampledata')
Resources
