envoyproxy / envoyproxy/gateway

APIKeyAuth secret safety question - possibility of using hashed values?

Open
#8,833 1 comment 0 reactions 0 assignees View on GitHub
stale triage
Dominant language
Go
Stars
3k
Forks
864
Avg merge
2d 2h
Merged PRs (30d)
140

Description

*Description*:
Per the configuration, the APIKeyAuth secret is a standard K8S opaque secret and the actual tokens are simply b64 encoded.

Has it been considered to enable the used of hashed secrets (SHA256|SHA512|somethingelse) to have some baseline security much like an htpasswd file provides?
This is beyond any considerations of the fact that someone could actually get hold of the secret.

Thank you,
Ed

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.