Playframework 2 - 存储您的凭据 [英] Playframework 2 - Storing your credentials

问题描述

我在哪里存储您的密钥，如密钥，邮件密码，数据库密码？

我在http://security.stackexchange.com/questions/19785/security-concerns-about-my-webapp/19786#19786

看来，存储凭据的最佳方法是在外部服务器上。

但play2使用application.conf来执行此操作。

更新1： b

好，我使用heroku。

我这样设置我的环境变量：

  heroku config：add test = ITWORKS 
  

conf添加

  sometest = $ {test} 
  

我试图访问它：

  Logger.info application（）。configuration（）。getString（sometest））; 
  

但我得到以下错误：

  UnresolvedSubstitution：conf\application.conf：54：无法解析替换为值：$ {test} 
  

所以我想play2没有找到变量测试，因为它是在heroku。但是我也在我的本地Windows环境中添加它 - >仍然有同样的错误。

任何想法是什么问题？

Update2：

好吧，我只需要在添加env变量后重新启动。

最后一个问题：

每次在我的本地计算机上添加系统变量很麻烦。是否有开发模式？

解决方案

广告。 3：在Play application.conf 不可通过任何路由或其他类型 path ，所以它不能被认为是放置在webroot。 Terry的建议是适当的PHP，但不适合Play（他警告说，他不知道框架当然）。他给出了一个PHP脚本示例，但是相信我，访问 http：//somdomain.tld/config.php 和Play的 conf之间的差异/application.conf 是巨大的。

在 application.conf 中存储凭据是最安全（最快）的方式现在，我不能想象一种方法来反编译文件在浏览器中，即使解析器会死（这是不可能的，因为它不是PHP）。如果您决定将凭据存储在某个较远的位置，则会遇到新的风险，因为您需要另外检查客户端是否有权限获取配置，应用程序启动所需的时间等将会上升等。 p>

更新1：

使用环境变量不是一种安全的方式 - ，它会出现在进程列表中，所以你会显示你的凭据给每个管理员，我很确定你不想这样做与ie。你的邮件。

在Heroku中，它是传递他们的数据库连接URL的一种方法，但是其他凭据应该存储在配置文件中。最后，请记住， Procfile命令长度有限到255个字符，因此将所有凭据放入其中将导致，您的应用程序赢得'

这种情况下的解决方法是使用别名配置文件，场景非常简单

1. 在 application.conf 保留生产数据库的URL如果它是Heroku最可能 db.default.user 和 db.default.password 应该注释为通用heroku URL包含凭据。


2. 对于您的本地版本创建一个文件ie： conf / local_postgres.conf 在开头包含application.conf并覆盖/添加所有必需的配置密钥，如凭据到您的本地Postgres DB。此外，您还可以设置其他内容，更改日志记录级别，启用 smtp.mock 等。



3. 与这个conf。 （注意，我有一些问题与 -Dconfig.resource 所以我不得不使用 -Dconfig.file 语法，你必须找到哪种方法在你的系统中工作良好）

    玩-Dconfig.resource = local_postgres.conf 〜run 9123
     

   
   
   提示：使用非默认端口是演示重新使用本地配置。如果你忘记了你有备用的配置，并使用通用的 play〜run 命令启动你的应用程序，你的应用程序位于 http：// localhost

   创建一个bash脚本 run-local （或Windows中的 run-local.bat 文件），并从上一个点放置命令。忽略它在 .gitignore 文件中。




将使用从第4点开始的脚本运行本地开发应用程序。在推送到Heroku时，将使用 application.conf 的值部署应用程序，因为您没有设置替代配置在Procfile中。还有一些其他组合，您可以使用Heroku的SQL在本地运行您的应用程序执行演变，而不推动它部署，或检查最新的修复包。当然，您必须始终确保您在本地版本的数据库上开发，否则可能会意外更改/销毁您的生活数据。

Update 2：

最后，使用 *。conf 如果你必须改变不同位置的配置（如上所述，团队使用相同的代码，dev / prod环境等）。

当然可以缩写为：

  import play.Configuration; 
 import play.Play; 
 
 // ... 
配置cfg = Play.application（）。configuration（）; 
 
 cfg.getString（smtp.password）; 
 cfg.getBoolean（smtp.mock）; 
 cfg.getInt（smtp.port）; 
  

Where do you store you credentials like secret key , mail passwords, db passwords?

I made a post on http://security.stackexchange.com/questions/19785/security-concerns-about-my-webapp/19786#19786

And it seems the best way to store the credentials is on an external server.

But play2 uses the application.conf to do this.

• So how and where do you store your credentials in play2?

Update 1:

Okay I am using heroku.

I set my enviroment variable like this:

heroku config:add test=ITWORKS

in application.conf I added

sometest=${test}

I trying to access it like this:

Logger.info(Play.application().configuration().getString("sometest"));

But I get the following error:

UnresolvedSubstitution: conf\application.conf: 54: Could not resolve substitution to a value: ${test}

So I guess play2 doesn't find the variable test because it is on heroku. But then I also added it in my local windows environment -> still the same error.

Any idea what is wrong?

Update2:

Okay it works, I just have to reboot after I added an env variable.

Last question:

It's kinda annoying to add the system variable everytime on my local machine. Is there a dev mode?

解决方案

ad. 3: In Play application.conf is not accesible via any route or other kind of path so it can not be considered as 'placed in webroot'. Terry's advice is proper in PHP, but doesn't fit to Play (he warned, that he don't know the framework of course). He gives a sample of PHP script, but believe me, the diffrence between access to http://somdomain.tld/config.php and Play's conf/application.conf is huge. They can't be compared directly.

Storing credentials in application.conf is the safest (and fastest) way for now, I can't imagine a way to decompile the file in browser even if parser would die (which isn't possible as it's not PHP). If you'll decide to store credentials in some distant location, you'll gain the new risk, as you will need to additionally check if client has permissions to get the config, time required for application's start will rise etc, etc.

Update 1:

Using environment variables is not a secure way - as Marius pointed, it will appear in the process list, so you will show your credentials to each admin and I'm pretty sure that you don't want do that with ie. your email.

In Heroku of course it's a way for passing their DB connection URL, but other credentials should be stored in config file. Finally remember that Procfile command length is limited to 255 chars, so placing all credential in it will cause, that your app won't start some day.

Resolution in this case is using alernative configuration files, scenario is quite simple

1. in your application.conf keep an URL to your production database If it's Heroku most probably db.default.user and db.default.password should be commented as common heroku URL contains credentials in it.
2. For your local version create a file ie: conf/local_postgres.conf include application.conf at the beginning and override/add all required configuration keys like credentials to your local Postgres DB. Additionally you can set there other things, change logging levels, enable smtp.mock, etc.

3. Run your app locally with this conf. (note, I had some problem with -Dconfig.resource so I had to use -Dconfig.file syntax instead, you have to find which method will be working good in your system) ie.

   play -Dconfig.resource=local_postgres.conf "~run 9123"
   

   Tip: Using non default port is the easiest way to "demonstrate" that you're working with local config. If you'll forget that you have alternative config and will start your app with common play ~run command, your app in location http://localhost:9123 will be just unavailable.

4. Create a bash script run-local (or run-local.bat file in Windows) and place there command from previous point. Ignore it in .gitignore file.

From now you'll be running the application for local development with the script from point 4. While pushing to Heroku it will deploy your app with values from application.conf as you don't set alternative config in the Procfile. What's more with some other combinations you can run locally your application with Heroku's SQL to perform evolutions without pushing it to deployment, or check newest fix-pack. Of course you have to always make sure that you're developing on the local version of database, otherwise there's a risk that you accidentally change/destroy your life data.

Update 2:

Finally using *.conf files is better than storing it in separate classes in case when you have to change configuration for different locations (as mentioned yet, team working on the same code, dev/prod environments etc.)

Of course can be shortened to:

import play.Configuration;
import play.Play;

// ...
Configuration cfg = Play.application().configuration();

cfg.getString("smtp.password");
cfg.getBoolean("smtp.mock");
cfg.getInt("smtp.port");

这篇关于Playframework 2 - 存储您的凭据的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！