I'm using rabbit-mq as the main communication method in my microservices. The names of each queue describe exactly what is the purpose of it. e.g "send-payment", "send-email" and so on.

Should I consider giving a random name for each queue to improve the security?


Security is not an universal thing that can just be "improved", just like code can't be "optimized" just like that. You can only optimize code to do something better (e.g. improve execution speed at possibly the cost of readability), just like you can improve security by protecting yourself against something.

So when you want to give your queues random names, what do you think it protects against? Not really anything, except that it makes debugging harder.

If your communication is in plaintext for the attacker to see, then a queue named ngGyUnGLyDNgRAadYnGMyCNgSGNgtaLaHy will seem more "cryptic" than a queue named send-email, but by observing the traffic, and attacker will be rather quick at determining what a specific queue does.

Could this be considered "improved" security? Not really. It only marginally inconveniences the attacker, while at the same time it annoys your developers. Imagine getting an error report involving a queue named ngGyUnGLyDNgRAadYnGMyCNgSGNgtaLaHy. Now the developer in question has to either look up which queue that was, or remember several cryptic names - either option is annoying.

In Summary: Don't rely on security by obscurity. Enable TLS and test your configuration, ensuring that it is configured correctly.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.