How do people keep real passwords out of a users.csv that has to be committed?

Asked 2 Mar 202312,180 views2 answers

31votes

Our pool CSV has a plaintext password column and security review flagged it, fairly. Options I can see are all bad:

gitignore the file, and every new joiner spends an afternoon working out why nothing runs
one shared password nobody minds leaking, which is a lie we will forget we told
generate the file in CI, and lose the ability to run anything locally

Is there a fourth thing?

data config pool

asked by Ify Adeyemi6,584 · 2 Mar 2023

2 answers

28votes✓
Accepted answer
There is. Cell values are interpolated the same way configuration is, so a password column can hold a reference instead of a value:
text
```
id,username,password,role,displayName
1,Heath93,${RWA_PASSWORD:-s3cret},standard,Ted Parisian
```
The file stays committed, reviewable and diffable, and the actual secret comes from .env, .env.<env> in the repo root or the project directory, or from the real environment in CI.
The :-default form is worth using deliberately. For a public sandbox the default is the demo credential and the file works out of the box. For a real environment, leave the default off so an unset variable is loud rather than wrong.
sdods data preview shows you the file, not the resolved row, so what you see is the placeholder:
sdods data preview reads the file, so the placeholder is what is on screen
The same rule is enforced in the yaml — a key that looks like a secret with a literal value is a CONFIG_SECRET_LITERAL error, so env.vars.standardPassword: hunter2 will not resolve at all. The data files are the one place you can still do the wrong thing by hand, so review for it.
Security
answered by Priya Venkateshmaintainer29,604 · 2 Mar 2023
9votes
What we settled on, if it helps: the committed CSV carries only ids, usernames, roles and display names, and every password cell is the same ${QA_ACCOUNT_PASSWORD} reference. The accounts are provisioned by a seeding script that sets them all to that one value in the test environment.
It means the CSV tells you nothing an attacker wants and still runs unchanged on any machine that has the variable.
answered by Renata Kohl608 · 21 Mar 2023

Have a different question? Ask it.

How do people keep real passwords out of a users.csv that has to be committed?

2 answers

Know the answer?

Related