Skip to content

Purpose of Azure Vault? #11

Open
Open
@TuxCoder

Description

@TuxCoder

When I read the code correctly the AzureSigner fetches the secret key from a website with some secret in the properties.

This has IMHO no security benefit to a secret key that is stored in the properties.
As an attacker can always fetch this secret when he has access to the web service.

For keeping stuff simpler and reduce dependencies I would recommend to remove this and replace it by a secret key as base64 decode in the properties.
Or generate it once the database get initialized and store it there, easier to handle for sysadmins.

Same security less code, full control, less failure points and easier testable.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions