Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Mask client secret and initiator password in debug #77

Merged
merged 6 commits into from
Nov 9, 2023

Conversation

c12i
Copy link
Owner

@c12i c12i commented Nov 9, 2023

Prevent client secret and initiator password visibility in Mpesa client debug

@c12i c12i added the security label Nov 9, 2023
@c12i c12i requested a review from itsyaasir November 9, 2023 11:21
@c12i c12i changed the title Mask client secret in debug Mask client secret and initiator password in debug Nov 9, 2023
src/client.rs Outdated Show resolved Hide resolved
@itsyaasir
Copy link
Collaborator

Hey Collins, I think there's another approach to hide the secret key, we can derive manual Debug on the MpesaClient debug and remove the fields from there.

@c12i c12i mentioned this pull request Nov 9, 2023
@c12i c12i changed the title Mask client secret and initiator password in debug Simplify auth method and mask client secret and initiator password in debug Nov 9, 2023
@c12i
Copy link
Owner Author

c12i commented Nov 9, 2023

Hey Collins, I think there's another approach to hide the secret key, we can derive manual Debug on the MpesaClient debug and remove the fields from there.

Thought of this too, but the secrecy crate provides the ability to wipe the secrets from memory on drop securely, this was the main reason I chose to go with the crate

@c12i c12i requested a review from itsyaasir November 9, 2023 14:56
@c12i c12i changed the title Simplify auth method and mask client secret and initiator password in debug Mask client secret and initiator password in debug Nov 9, 2023
@itsyaasir
Copy link
Collaborator

Hey Collins, I think there's another approach to hide the secret key, we can derive manual Debug on the MpesaClient debug and remove the fields from there.

Thought of this too, but the secrecy crate provides the ability to wipe the secrets from memory on drop securely, this was the main reason I chose to go with the crate

That is great, We can go for this

@c12i c12i merged commit e373905 into master Nov 9, 2023
11 checks passed
@c12i c12i deleted the mask-client-secret-in-debug branch November 9, 2023 16:00
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants