These days, almost any service you interact with through an API will require some sought of permissions to be able to use it. These permissions are done through the use of what is known as API keys, which is a sequence of some characters. These act like the username and password you use when logging in to any website and we all know how much we would not want to share those credentials with others. That is how we have to treat these keys as well, because when they get into the wrong hands, they can be used to perpetuate acts you have not yet prepared for. Some might include:
- Unauthorized Data Access: A malicious actor could misuse stolen API keys to gain unauthorized access to sensitive data.
- Resource Overuse: An attacker might use compromised keys to overload a service, causing downtime or additional costs.
Securing API Keys: Best Practices
To bolster the security of API keys, a fundamental approach is to leverage Environment Variables within your source code. Environment variables are external to your program and should never appear explicitly in your codebase. As the name suggest, they are variables, and we all know variables store values. But then, when you reference the variable, you get the value in place of it, and this value, you might not be aware of. When you reference an environment variable, you retrieve its value, which remains concealed from your code. These variables are typically configured at the system level and can be accessed by the executing program. A typical way of getting environment variables in python is using the os module.
import os
secret_key = os.environ.get("HIGHLY_IMPORTANT_SECRET")
The actual value of secret_key isn't known until runtime, and it can vary based on the environment, enhancing security by keeping sensitive information hidden.
Embracing Security Audits
As we grow in the field on engineering and software building, we should not only take into consideration that because a code is running, it is okay to be pushed to the general public. As engineers, we also need to sit down, analyze typical bugs we might have present and also, the security of the code we have written. Rushing to deploy features might lead to exposing private information unintentionally. For instance, directly embedding an API key without proper handling can be a security risk. An example will be you passing an API key directly into a variable without using a method like we discussed about, due to the rush to get things done.
We must learn to add to the pipeline before deploying, the need to sit down and perform some auditing before going ahead to push out our changes. These days, any slight loophole an attacker gets within your system, they tend to really do great dame with it.
Libraries we use in our codes can also contribute to the overall security weakness of our application. We should really try as much as possible to stay away from packages or libraries that have not been maintained in a really long time. While the advice against reinventing the wheel is well-known, choosing a package that hasn't been updated in five years might end up causing more harm than spending a bit of time to create it yourself.
For code checks and auditing, there are various 3rd party services that we can use, some even, directly within our IDEs. By integrating these tools, you can identify and mitigate security concerns before they become real threats.. I will leave some links below so you check them out.
In conclusion, safeguarding API keys and fortifying your application against security risks are paramount. Employing environment variables, conducting thorough security audits, and leveraging third-party tools all contribute to maintaining a robust and secure software ecosystem.
Top comments (1)
Nice read, thank you Kelvin.