All geek questions in one place

Secure data storage in Node CLI application

I am currently writing a NodeJS command line application. The application makes an API call and returns some data to the user. Given that this is a public API, the user needs an API token. This CLI will be installed globally on the user computer via npm i -g super-cool-api-cli .

The first time the user launches the CLI, they request a token, and then I store it so that every subsequent time it starts, they do not need to enter it. I provided the user with a way to reset this too. I store it in the actual directory of my CLI module, which, as indicated, is installed globally and looks something like this:

 fs.writeFile( __dirname+'/.token.json', JSON.stringify( { "token": token }, null, 2 ), 'utf8', (e)=>{ // error handling and whatever });

I call the .token.json file, using a dot to at least make the file hidden by default.

I assume I am asking if there is a better / safer way to store sensitive information in a NodeJS command-line application that you will run more than once. I was thinking about using things like environment variables , but they seem to end at the end of the process.

Security is a skill that I'm a little lacking, but really want to know more, so be sure to give your advice in advance.

+5
source share
2 answers

I think it’s best to use the credential storage facilities provided by the OS for this kind of thing, assuming, of course, that each user has their own account on the machine. The only NPM package I know handles node-keytar .

+4
source

You can save the token in sqlite and set the username / password for sqlite.db file, here are the bindings for sqlite https://github.com/mapbox/node-sqlite3

+1
source

Source: https://habr.com/ru/post/1242585/

More articles:


All Articles