|
1 | 1 | .. index::
|
2 | 2 | single: Secrets
|
3 | 3 |
|
4 |
| -How to Keep Sensitive Informations Secret |
5 |
| -========================================= |
| 4 | +How to Keep Sensitive Information Secret |
| 5 | +======================================== |
6 | 6 |
|
7 | 7 | In :doc:`/configuration` and :doc:`/configuration/environment_variables`, you
|
8 | 8 | learned how to manage your application configuration. In this article you'll
|
9 |
| -learn how to easily anbd saftly configure your application with sensitive |
10 |
| -information such as credentials, passwords, tokens, api keys without exposing |
11 |
| -them. |
| 9 | +learn how to safely configure your application with sensitive information such |
| 10 | +as credentials, passwords, tokens, API keys without exposing them. |
12 | 11 |
|
13 | 12 | .. _secrets-configuration:
|
14 | 13 |
|
15 | 14 | Configuration
|
16 | 15 | -------------
|
17 | 16 |
|
18 | 17 | In order to use secrets you have to enable the feature in the framework's
|
19 |
| - |
20 | 18 | configuration:
|
| 19 | + |
21 | 20 | .. configuration-block::
|
22 | 21 |
|
23 | 22 | .. code-block:: yaml
|
@@ -50,74 +49,67 @@ configuration:
|
50 | 49 | 'secrets' => true,
|
51 | 50 | ]);
|
52 | 51 |
|
53 |
| -.. tip:: |
54 |
| - |
55 |
| - the ``encryption_key`` configuration parameter accept both a path to an |
56 |
| - encription key or the content of the itself. It allows you, for instance, |
57 |
| - to store the content of the key in an environement variable and refer it |
58 |
| - with ``%env(PRIVATE_KEY)%``. |
59 |
| - |
60 | 52 | .. _secrets-generate-key:
|
61 | 53 |
|
62 | 54 | Generate an Encryption Key
|
63 | 55 | --------------------------
|
64 | 56 |
|
65 |
| -Before creating a new ``secret``, you need to create ann ``encryption key``. |
66 |
| -This can be done with the provided commande ``secrets:generate-key``. |
| 57 | +Before creating a new **secret**, you need to create an **encryption key**. |
| 58 | +This can be done with the provided command ``secrets:generate-key``. |
67 | 59 |
|
68 | 60 | .. code-block:: terminal
|
69 | 61 |
|
70 | 62 | $ APP_ENV=prod php bin/console secrets:generate-key
|
71 | 63 |
|
72 |
| -This command will generate a new ``encryption key`` in. |
| 64 | +This command generates a new **encryption key** in |
73 | 65 | ``%kernel.project_dir%/config/secrets/encryption_%kernel.environment%.key``
|
74 | 66 |
|
75 | 67 | .. note::
|
76 | 68 |
|
77 |
| - In order to use Symfony's built-in Secret storage, you will need the |
| 69 | + In order to use Symfony's built-in secret storage, you will need the |
78 | 70 | `libsodium`_ PHP extension or use the `sodium_compat`_ package.
|
79 | 71 |
|
80 |
| -Symfony generates a key with a symetrics algorithm, meaning that this key could |
| 72 | +Symfony generates a key with a symmetric algorithm, meaning that this key could |
81 | 73 | be used to both encrypt **and** decrypt secrets. The number of people who
|
82 | 74 | possess this key should be as small as possible.
|
83 | 75 |
|
84 | 76 | .. caution::
|
85 | 77 |
|
86 |
| - This file is sensitive and **must not** be commited nor publicly shared. Every |
87 |
| - developpers and CI don't need that key. If the encryption key have been |
88 |
| - exposed (ex-employee leaving for instance)you should consider regenerating a |
89 |
| - new one. |
| 78 | + This file is sensitive and **must not** be committed nor publicly shared. |
| 79 | + Your team developers and Continuous Integration services don't need that |
| 80 | + key. If the **encryption key** have been exposed (ex-employee leaving for |
| 81 | + instance), you need to generate a new one. |
90 | 82 |
|
91 | 83 | .. _secrets-add:
|
92 | 84 |
|
93 | 85 | Create a Secret
|
94 | 86 | ---------------
|
95 | 87 |
|
96 |
| -Once the ``encryption key`` generated, you can add new secret with the command |
97 |
| -``secrets:add``. Symfony'll ask you to enter the text to encrypt and generate |
98 |
| -a new file contains the ciphered text in a file stored by default in the folder |
99 |
| -%kernel.project_dir%/config/secrets/%kernel.environment%/. This file should be |
100 |
| -commited allongside the other project's files. |
| 88 | +Once the **encryption key** generated, you can add new secret with the command |
| 89 | +``secrets:add``. Symfony will ask you to enter the secret in order to encrypt |
| 90 | +and generate a new file containing the encrypted secret. This file is stored by |
| 91 | +default in the folder ``%kernel.project_dir%/config/secrets/%kernel.environment%/``. |
| 92 | +This file should be committed along side the other project's files. |
101 | 93 |
|
102 | 94 | .. code-block:: terminal
|
103 | 95 |
|
104 | 96 | $ APP_ENV=prod php bin/console secrets:add DATABASE_PASSWORD
|
105 | 97 |
|
106 | 98 | .. tip::
|
107 | 99 |
|
108 |
| - If the ``encryption key`` is compromized, you can regenerate a new key with |
109 |
| - the command ``secrets:generate-key``. Symfony will decrypt the previous |
110 |
| - secret with the old key, adn re-encrypt theme with the new one. |
| 100 | + If the **encryption key** is compromized, you can regenerate a new key with |
| 101 | + the command ``secrets:generate-key``. Symfony will decrypt previous secrets |
| 102 | + with the old key, and re-encrypt them with the new one. |
111 | 103 |
|
112 | 104 | .. _secrets-reference:
|
113 | 105 |
|
114 | 106 | Referencing Secrets in Configuration Files
|
115 | 107 | ------------------------------------------
|
116 | 108 |
|
117 |
| -You can reference those secrets in any configuration option enclosing their |
118 |
| -names using the ``secret`` :ref:`environment variable processors <env-var-processors>`. |
| 109 | +You can reference the secrets in any configuration option enclosing their names |
| 110 | +using the **secret** :ref:`environment variable processors <env-var-processors>`. |
119 | 111 | Their actual values will be resolved at runtime (once per request), so that
|
120 |
| -container compilation and cache warmup don't need the ``encryption key``. |
| 112 | +container compilation and cache warmup don't need the **encryption key**. |
121 | 113 |
|
122 | 114 | .. configuration-block::
|
123 | 115 |
|
@@ -159,11 +151,11 @@ container compilation and cache warmup don't need the ``encryption key``.
|
159 | 151 | ]
|
160 | 152 | ]);
|
161 | 153 |
|
162 |
| -This bellow configuration requires that every environment use secrets. each |
163 |
| -environment would have it own ``encryption key`` and encŷpted secrets. |
| 154 | +This configuration requires that all environments uses secrets. Each |
| 155 | +environment would have its own **encryption key** and encrypted secrets. |
164 | 156 |
|
165 |
| -You can also use parameters to configure diffrent strategy per environnement: |
166 |
| -By defining a default plaintext secret: |
| 157 | +You can also use parameters to configure different strategies per environnement: |
| 158 | +By defining a default plain text secret: |
167 | 159 |
|
168 | 160 | .. configuration-block::
|
169 | 161 |
|
@@ -213,7 +205,7 @@ By defining a default plaintext secret:
|
213 | 205 | ]);
|
214 | 206 | $container->setParameter('database_password', 'not a secret');
|
215 | 207 |
|
216 |
| -Then overriding it in production environement: |
| 208 | +Then overriding it in production environment: |
217 | 209 |
|
218 | 210 | .. configuration-block::
|
219 | 211 |
|
@@ -251,27 +243,27 @@ Then overriding it in production environement:
|
251 | 243 | List existing secrets
|
252 | 244 | ---------------------
|
253 | 245 |
|
254 |
| -Every body is allowed to list the secret's name with the command ``secrets:list``. |
255 |
| -If you have the ``encryption key`` you can also reveal the plain text value by |
256 |
| -passing the optoin ``--reveal`` to the command |
| 246 | +Everybody is allowed to list the secret's name with the command ``secrets:list``. |
| 247 | +If you have the **encryption key** you can also reveal the secret value by |
| 248 | +passing the option ``--reveal`` to the command |
257 | 249 |
|
258 | 250 | .. code-block:: terminal
|
259 | 251 |
|
260 | 252 | $ APP_ENV=prod php bin/console secrets:list --reveal
|
261 | 253 |
|
262 | 254 | ------------------- ------------------
|
263 |
| - key plaintext secret |
| 255 | + key secret |
264 | 256 | ------------------- ------------------
|
265 | 257 | DATABASE_PASSWORD my-secret
|
266 | 258 | ------------------- ------------------
|
267 | 259 |
|
268 | 260 | .. _secrets-deploy
|
269 | 261 |
|
270 |
| -Deploy secret to production |
271 |
| ---------------------------- |
| 262 | +Deploy secrets to production |
| 263 | +---------------------------- |
272 | 264 |
|
273 |
| -As the ``encryption key`` is not commited, during development, you'll have to |
274 |
| -manualy deploy the key (once for a will) at the path referenced in the |
| 265 | +As the **encryption key** is not committed, during development, you'll have to |
| 266 | +manualy deploy the key (once and for all) at the path referenced in the |
275 | 267 | ``encryption_key`` configuration key. Default is ``%kernel.project_dir%/config/secrets/%kernel.environment%``.
|
276 | 268 |
|
277 | 269 | .. _secrets-custom-storage
|
|
0 commit comments