8

In relation to this GitHub issue on the Gittip project (which turned out to be a false alarm), what are the security implications, if any, of hardcoding into the git repo a test app's OAuth consumer key and secret for each provider that we use.

The intention is to make it as simple as possible for a new developer to spin up a working development environment, and asking them to create a bunch of OAuth apps seemed undesirable.

For what it's worth, the details are as follows:

  • assume local site development only (no remote data stores)
  • providers include Twitter, GitHub, OpenStreetMaps, Bitbucket, Venmo, among others
  • publicized secrets are only for testing apps
Improve this question
3
  • Are the test credentials good on any publicly accessible server or only on local servers that developers set up for testing (and presumably protect from public access)? If the test credentials can be used on any publicly accessible server, they will be, and someone will figure out a way to do something you don't like. It might just be a DOS attack. Think about the functions being tested. Are any of them privileged in any way? Think like a cracker. Could you use the test creds to break into anything of value?
    – Tom Barron
    Apr 22, 2014 at 22:46
  • It sounds like maybe the real question is how secure your various providers (Twitter, GitHub, OpenStreetMaps, Bitbucket, Venmo, others) are. How possible would it be to use your test credentials to access someone else's information? That depends on how strong the provider security is.
    – Tom Barron
    Apr 22, 2014 at 22:51
  • @tom We were actually using postgression for a bit, which is an API that works over http to get credent but ials for a db that it spins up. THAT was a bad idea in retrospect, but it seems it was used by very few people. So I'm kinda concluding that we're ok as long as the development stayed local, as the access token (which are needed to do any damage with the consumer secret) would just be on the user's computer :)
    – patcon
    Apr 24, 2014 at 0:12

1 Answer 1

Reset to default
1

Could you make the configuration file local only and not check that in?

Or just share the configuration file / API keys to a limited audience?

Sharing a key makes it a single point of failure as well. If it's a limited test account you can remove if needed, you have much better control. You need to be aware of the terms of those accounts as well (Twitter, Github, OpenStreetMaps, etc...) to make sure you aren't violating their terms of service by hosting API ids as freely downloadable content.

Agree that it's not the best from a developer usability perspective, but your developers should use their own API keys to achieve account isolation and protect you and others. This does effect startup time, maybe there is a project out there to simplify this for developers? C'mon interwebs, get on it.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .