Loading…
16
Pro tip: the old security guy at my first job taught me more about API keys in one lunch than 3 years of docs
Back in 2019 I was a junior dev at a small shop in Sacramento and we had this contractor named Ray who had been doing security since the dial-up days. One day I was hardcoding an API key right into the frontend because I did not know any better, and he just leaned over and asked me one thing: who else can see this file? I said everyone, and he nodded and said that is the whole problem right there. He showed me how easy it was to pull keys out of a browser dev tools window in about 30 seconds, and I have never put a secret in client code since. Now everything I build uses a proxy or a vault and short lived tokens. What is the one lesson about key handling that stuck with you early on?
0 comments
Log in to join the discussion
Log In0 Comments
No comments yet
Be the first to share your thoughts on this discussion.