3

I want to store third party API secret (like AWS) of my users in database. Leakage of which can lead to a potential loss to my users. It should be kept confidential.

So how can I secure their data on NodeJS platform? I'm thinking to encrypt and store the store the secret key so it will not directly visible to intruders.

Any suggestion on how more security can be maintained?

var crypto = require('crypto');
var assert = require('assert');

var algorithm = 'aes256'; // or any other algorithm supported by OpenSSL
var key = 'password';
var text = 'I love kittens';

var cipher = crypto.createCipher(algorithm, key);  
var encrypted = cipher.update(text, 'utf8', 'hex') + cipher.final('hex');

var decipher = crypto.createDecipher(algorithm, key);
var decrypted = decipher.update(encrypted, 'hex', 'utf8') + 
decipher.final('utf8');

console.log(encrypted);
console.log(decrypted);

assert.equal(decrypted, text);
2

It's always best if you can use a system that doesn't require storing reversible secrets. But in some cases, it is required.

Rather than relying on yourself to get crypto construction correct, it's best to rely on a vetted third party library, and this is precisely the niche NaCl was designed to fill. There are many options for using it, in some form or another, in JavaScript:

The exact API will differ depending on the library you choose, but in general what you're looking for is called secret box.


An alternate approach is to avoid handling storage entirely by outsourcing even that. There are a number of products for storing secrets, including hardware devices. If you're using a public cloud, it probably has a service (here is Amazon's). And Hashicorp's Vault can be run wherever and gives you a lot of control.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.