1
1
.. index ::
2
2
single: Secrets
3
3
4
- How to Keep Sensitive Informations Secret
5
- =========================================
4
+ How to Keep Sensitive Information Secret
5
+ ========================================
6
6
7
7
In :doc: `/configuration ` and :doc: `/configuration/environment_variables `, you
8
8
learned how to manage your application configuration. In this article you'll
9
- learn how to easily anbd saftly configure your application with sensitive
10
- information such as credentials, passwords, tokens, api keys without exposing
9
+ learn how to easily and saftely configure your application with sensitive
10
+ information such as credentials, passwords, tokens, API keys without exposing
11
11
them.
12
12
13
13
.. _secrets-configuration :
@@ -16,8 +16,8 @@ Configuration
16
16
-------------
17
17
18
18
In order to use secrets you have to enable the feature in the framework's
19
-
20
19
configuration:
20
+
21
21
.. configuration-block ::
22
22
23
23
.. code-block :: yaml
@@ -52,29 +52,29 @@ configuration:
52
52
53
53
.. tip ::
54
54
55
- the ``encryption_key `` configuration parameter accept both a path to an
56
- encription key or the content of the itself. It allows you, for instance,
57
- to store the content of the key in an environement variable and refer it
58
- with ``%env(PRIVATE_KEY)% ``.
55
+ The ``encryption_key `` configuration parameter accept both a path to an
56
+ encryption key or the content of the key itself. It allows you, for
57
+ instance, to store the content of the key in an environment variable and
58
+ refer it with ``%env(PRIVATE_KEY)% ``.
59
59
60
60
.. _secrets-generate-key :
61
61
62
62
Generate an Encryption Key
63
63
--------------------------
64
64
65
- Before creating a new ``secret ``, you need to create ann ``encryption key ``.
66
- This can be done with the provided commande ``secrets:generate-key ``.
65
+ Before creating a new ``secret ``, you need to create an ``encryption key ``.
66
+ This can be done with the provided command ``secrets:generate-key ``.
67
67
68
68
.. code-block :: terminal
69
69
70
70
$ APP_ENV=prod php bin/console secrets:generate-key
71
71
72
- This command will generate a new ``encryption key `` in.
72
+ This command generate a new ``encryption key `` in
73
73
``%kernel.project_dir%/config/secrets/encryption_%kernel.environment%.key ``
74
74
75
75
.. note ::
76
76
77
- In order to use Symfony's built-in Secret storage, you will need the
77
+ In order to use Symfony's built-in secret storage, you will need the
78
78
`libsodium `_ PHP extension or use the `sodium_compat `_ package.
79
79
80
80
Symfony generates a key with a symetrics algorithm, meaning that this key could
@@ -83,21 +83,21 @@ possess this key should be as small as possible.
83
83
84
84
.. caution ::
85
85
86
- This file is sensitive and **must not ** be commited nor publicly shared. Every
87
- developpers and CI don't need that key. If the encryption key have been
88
- exposed (ex-employee leaving for instance)you should consider regenerating a
89
- new one.
86
+ This file is sensitive and **must not ** be commited nor publicly shared.
87
+ Every developpers and CI don't need that key. If the encryption key have
88
+ been exposed (ex-employee leaving for instance), you should consider
89
+ regenerating a new one.
90
90
91
91
.. _secrets-add :
92
92
93
93
Create a Secret
94
94
---------------
95
95
96
96
Once the ``encryption key `` generated, you can add new secret with the command
97
- ``secrets:add ``. Symfony'll ask you to enter the text to encrypt and generate
98
- a new file contains the ciphered text in a file stored by default in the folder
99
- %kernel.project_dir%/config/secrets/%kernel.environment%/. This file should be
100
- commited allongside the other project's files.
97
+ ``secrets:add ``. Symfony will ask you to enter the text to encrypt and generate
98
+ a new file containing the ciphered text in a file stored by default in the
99
+ folder `` %kernel.project_dir%/config/secrets/%kernel.environment%/ `` . This file
100
+ should be commited along side the other project's files.
101
101
102
102
.. code-block :: terminal
103
103
@@ -107,15 +107,15 @@ commited allongside the other project's files.
107
107
108
108
If the ``encryption key `` is compromized, you can regenerate a new key with
109
109
the command ``secrets:generate-key ``. Symfony will decrypt the previous
110
- secret with the old key, adn re-encrypt theme with the new one.
110
+ secret with the old key, and re-encrypt theme with the new one.
111
111
112
112
.. _secrets-reference :
113
113
114
114
Referencing Secrets in Configuration Files
115
115
------------------------------------------
116
116
117
- You can reference those secrets in any configuration option enclosing their
118
- names using the ``secret `` :ref: `environment variable processors <env-var-processors >`.
117
+ You can reference the secrets in any configuration option enclosing their names
118
+ using the ``secret `` :ref: `environment variable processors <env-var-processors >`.
119
119
Their actual values will be resolved at runtime (once per request), so that
120
120
container compilation and cache warmup don't need the ``encryption key ``.
121
121
@@ -159,10 +159,10 @@ container compilation and cache warmup don't need the ``encryption key``.
159
159
]
160
160
]);
161
161
162
- This bellow configuration requires that every environment use secrets. each
163
- environment would have it own ``encryption key `` and encŷpted secrets.
162
+ This configuration requires that all environments uses secrets. Each
163
+ environment would have its own ``encryption key `` and encrypted secrets.
164
164
165
- You can also use parameters to configure diffrent strategy per environnement:
165
+ You can also use parameters to configure different strategies per environnement:
166
166
By defining a default plaintext secret:
167
167
168
168
.. configuration-block ::
@@ -213,7 +213,7 @@ By defining a default plaintext secret:
213
213
]);
214
214
$container->setParameter('database_password', 'not a secret');
215
215
216
- Then overriding it in production environement :
216
+ Then overriding it in production environment :
217
217
218
218
.. configuration-block ::
219
219
@@ -251,7 +251,7 @@ Then overriding it in production environement:
251
251
List existing secrets
252
252
---------------------
253
253
254
- Every body is allowed to list the secret's name with the command ``secrets:list ``.
254
+ Everybody is allowed to list the secret's name with the command ``secrets:list ``.
255
255
If you have the ``encryption key `` you can also reveal the plain text value by
256
256
passing the optoin ``--reveal `` to the command
257
257
@@ -271,7 +271,7 @@ Deploy secret to production
271
271
---------------------------
272
272
273
273
As the ``encryption key `` is not commited, during development, you'll have to
274
- manualy deploy the key (once for a will ) at the path referenced in the
274
+ manualy deploy the key (once and for all ) at the path referenced in the
275
275
``encryption_key `` configuration key. Default is ``%kernel.project_dir%/config/secrets/%kernel.environment% ``.
276
276
277
277
.. _secrets-custom-storage
0 commit comments