A shop app with its password inside
A student builds an app for a family takeaway. It takes orders and saves them to a database. To make it work quickly, they type the database password straight into the code.
Then they share the code on a public website so a friend can help. Within a day, somebody they have never met has signed in to the database.
The one rule
Warning
This app hides fake secrets badly on purpose. Look only into your own private copy, with your teacher's permission. It has no way out to the internet. Using a secret you found to get into a real system is a crime under the Computer Misuse Act 1990. We find secrets so we can move them somewhere safe.
By the end of this lesson
Note
I can find a secret left in code.
Key words
| Word | What it means |
|---|---|
| Secret | a password, key or token that must stay private |
| Source code | the text a program is written in |
| Environment variable | a setting the computer gives a program when it starts |
| Secrets manager | a locked store that hands out secrets to programs |
| Rotate | replace a secret with a new one and stop the old one working |
The cells students fill in are left blank in this preview.
Before you start
Note
Press Start the lab on the bar at the top. WrongSecrets takes about a minute to wake up. Each Run types its command into the terminal beside it. The Runs only ask the app questions. Wait until the first one prints UP.
A secret belongs outside the code
Code is copied all the time: to a laptop, to a code store, to a friend, to a backup. A secret written into code goes everywhere the code goes.
So the code should only say where to get the secret. The secret itself comes from an environment variable or a secrets manager when the program starts.
WrongSecrets breaks this rule on purpose, in many different ways. First, check it is running.
Is the app running?
curl -s -w "\n" http://wrongsecrets:8080/actuator/healthShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Worked example: one setting, three places
| Where the password is | Who can read it | Verdict |
|---|---|---|
| Typed in the code: db_password = "takeaway22" | Anybody who ever gets a copy of the code | Wrong |
| An environment variable on the server | The program, and the people who run the server | Better |
| A secrets manager | Only the programs given permission | Best |
The cells students fill in are left blank in this preview.
Some secrets leak through pages
Many apps have management pages for the people who run them. They report health, settings and recent events. Left open, they tell strangers about the inside of the app.
The first Run asks WrongSecrets for its list of these pages. The second asks for one that would show every setting, env.
Which management pages are open?
curl -s http://wrongsecrets:8080/actuator | grep -o 'actuator/[a-z]*' | sort -uShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Is the settings page open?
curl -s -o /dev/null -w "%{http_code}\n" http://wrongsecrets:8080/actuator/envShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
A script sent to the browser is public
Everything a browser downloads, a visitor can read. That includes the scripts that make a page work.
Some developers scramble a script so it looks unreadable. That is not hiding. The browser still has every character, and so does anybody who asks for the file.
The start of a script every visitor gets
curl -s http://wrongsecrets:8080/js/index.js | head -n 1 | cut -c 1-120Shown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
A common mistake
Warning
Many people think deleting a password from the code removes it. A code store keeps every old version, so the password is still in the history. Once a secret has been shared, rotate it: make a new one and stop the old one working.
Going further: no false alarms
A scanner that shouts about everything gets ignored. Write five lines of your own that looks_like_secret should not flag, and check each one.
Include a comment about a password, a short placeholder and a value read from the environment. Then find one line it flags wrongly, and write the rule you would add.