4

I'm building a private web app that I plan to use between myself and a few select friends. Each of us have API keys for a 3rd party service that my web app needs to access so it can call the 3rd party service API's and return data we want to evaluate together.

Because this is a private / static web app, I don't feel the need to store these keys in a database and am hoping to store these keys directly on my web server.

If I take this route, what are the main security risks? Should I consider somehow encrypting these API keys on my web server disk and decrypting them inside my web app only when I need to use them? (if so, any guidance on this?)

I've done standard web development for a long time now, but lack terribly in my knowledge of web security. I'd appreciate any guidance or thoughts!

Improve this question
3
  • How many keys per user, and how many users?
    – jrtapsell
    Feb 11, 2018 at 8:18
  • The issue of security hinges on what exactly is meant by "private / static" web app, and how you intend to restrict access to "a few select friends." If truly "private"- meaning that access to the network/infra the app is running is truly limited to you and friends, the risks are minimal. If the app is running on public cloud, then there is no enforcement of "private" and storing keys is more of an antipattern. Feel free to update the question with more context around how the app is hosted.
    – Jonah Benton
    Feb 11, 2018 at 22:37
  • What O/S? Windows? Linux?
    – John Wu
    Dec 19, 2022 at 1:13

1 Answer 1

Reset to default
0

One recommendation would be to specify the API keys in the script running your application server. Ensure permissions of the script is execute only, owned by a dedicated user. Your application can read those keys via environment or system variables.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.