Repository navigation
security: stop persisting and returning secret values in plaintext - #2
Merged
Merged
Conversation
The secrets table persisted each value twice: an encrypted copy (encryptedValue + iv) AND a plaintext copy in a non-nullable `value` column. createSecret/updateSecret/rotateSecret wrote the plaintext, and the secrets API returned the entity as-is, so every secret was readable in cleartext from the database and over the API - defeating the encryption entirely. - Remove the plaintext `value` column from the Secret entity and stop writing it (create/update/rotate now persist only encryptedValue + iv) - Add migration 1730000000000 to drop the column from existing databases - Add SecretService tests asserting the entity has no plaintext field and that create/rotate never persist one
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #1
Problem
config-servicepersisted every secret in plaintext (secrets.value) in addition to the encrypted copy, and returned that entity from the secrets API — so the AES encryption protected nothing.Changes
src/entities/secret.entity.ts— removed the plaintextvaluecolumn.src/modules/secret/secret.service.ts—createSecret,updateSecretandrotateSecretno longer write plaintext; onlyencryptedValue+ivare stored. Values continue to be readable throughgetSecretValue()(decrypt).src/migrations/1730000000000-RemovePlaintextSecretValue.ts— drops thevaluecolumn from existing databases (down()restores an empty column, since the original cleartext cannot be recovered).test/secret.service.spec.ts— new tests: the entity has novalueproperty, and create/rotate never persist a plaintext field.Verification (in
microservices/config-service)Note
For non-production environments
synchronizeis enabled, so the schema updates automatically from the entity; production applies the new migration. A follow-up will redactencryptedValue/ivfrom API responses.