A developer pushes an application to production. The application receives a webhook over HTTPS without a secret. The webhook information contains credentials to service in cleartext. When the information is received, it is stored in the database with an SHA-256 hash. Credentials to the database are accessed at runtime through the use of a vault service.
While troubleshooting, the developer sets the logging to debug to view the message from the webhook. What is the security issue in this scenario?

Question

A developer pushes an application to production. The application receives a webhook over HTTPS without a secret. The webhook information contains credentials to service in cleartext. When the information is received, it is stored in the database with an SHA-256 hash. Credentials to the database are accessed at runtime through the use of a vault service.

While troubleshooting, the developer sets the logging to debug to view the message from the webhook. What is the security issue in this scenario?

Jozsef Stelly · Accepted Answer

During the transport of webhook messages, the credentials could be unencrypted and leaked.

Jozsef Stelly · Answer

Database credentials should be accessed by using environment variables defined at runtime.

Jozsef Stelly · Answer

During logging, debugging should be disabled for the webhook message.

Jozsef Stelly · Answer

Hashing the credentials in the database is not secure enough; the credentials should be encrypted.

Question list

List of questions

Question 1

(0)

Question 2

(0)

Question 3

(0)

Question 4

(0)

Question 5

(0)

Question 6

(0)

Question 7

(0)

Question 8

(0)

Question 9

(0)

Question 10

(0)

Related questions

Question 246 - 200-901 discussion

Suggested answer: B

0 comments