Kong / Kong/insomnia

Is it safe to store sensitive data in environment variables? (e.g. apiKey)

Open
#2,145 3 comments 1 reaction 0 assignees View on GitHub
C-question needs-triage
Dominant language
TypeScript
Stars
40k
Forks
2.4k
Avg merge
2d 13h
Merged PRs (30d)
61

Description

In our system there is a custom authentication method which is similar to Amazon’s AWS4 authentication but not the same.
That is why we would like to create a plugin which will be able to do the authentication process providing sensitive data by the environment variables.
As we see the environment variables are stored in `insomnia.Environment.db` file on the filesystem without any encryption.
Is it safe enough or is there a safer way to set and store for example an apiKey inside Insomnia?

I've only found an example where the documentation recommends to use environment variables for apiKey.
https://support.insomnia.rest/article/18-environment-variables

Thank you for your answers in advance.

Contributor guide

Open the contributing guide

Research direction

Start by reviewing the documented environment-variable guidance and inspecting Insomnia.Environment.db to confirm how values are stored. Compare that behavior with the requested custom authentication and plugin use case; done would require an agreed safer storage mechanism and corresponding security guidance.

Written by the indexing model from the issue text.

Assessment

Domain
security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.