envoyproxy / envoyproxy/gateway
APIKeyAuth secret safety question - possibility of using hashed values?
Open
stale
triage
- Dominant language
- Go
- Stars
- 3k
- Forks
- 864
- Avg merge
- 2d 2h
- Merged PRs (30d)
- 140
Description
*Description*:
Per the configuration, the APIKeyAuth secret is a standard K8S opaque secret and the actual tokens are simply b64 encoded.
Has it been considered to enable the used of hashed secrets (SHA256|SHA512|somethingelse) to have some baseline security much like an htpasswd file provides?
This is beyond any considerations of the fact that someone could actually get hold of the secret.
Thank you,
Ed
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.