1
1
.. index ::
2
2
single: Secrets
3
3
4
- How to Keep Sensitive Informations Secret
5
- =========================================
4
+ How to Keep Sensitive Information Secret
5
+ ========================================
6
6
7
7
In :doc: `/configuration ` and :doc: `/configuration/environment_variables `, you
8
8
learned how to manage your application configuration. In this article you'll
9
- learn how to easily anbd saftly configure your application with sensitive
10
- information such as credentials, passwords, tokens, api keys without exposing
9
+ learn how to easily and saftely configure your application with sensitive
10
+ information such as credentials, passwords, tokens, API keys without exposing
11
11
them.
12
12
13
13
.. _secrets-configuration :
@@ -16,8 +16,8 @@ Configuration
16
16
-------------
17
17
18
18
In order to use secrets you have to enable the feature in the framework's
19
-
20
19
configuration:
20
+
21
21
.. configuration-block ::
22
22
23
23
.. code-block :: yaml
@@ -50,31 +50,24 @@ configuration:
50
50
'secrets' => true,
51
51
]);
52
52
53
- .. tip ::
54
-
55
- the ``encryption_key `` configuration parameter accept both a path to an
56
- encription key or the content of the itself. It allows you, for instance,
57
- to store the content of the key in an environement variable and refer it
58
- with ``%env(PRIVATE_KEY)% ``.
59
-
60
53
.. _secrets-generate-key :
61
54
62
55
Generate an Encryption Key
63
56
--------------------------
64
57
65
- Before creating a new `` secret `` , you need to create ann `` encryption key `` .
66
- This can be done with the provided commande ``secrets:generate-key ``.
58
+ Before creating a new ** secret ** , you need to create an ** encryption key ** .
59
+ This can be done with the provided command ``secrets:generate-key ``.
67
60
68
61
.. code-block :: terminal
69
62
70
63
$ APP_ENV=prod php bin/console secrets:generate-key
71
64
72
- This command will generate a new `` encryption key `` in.
65
+ This command generates a new ** encryption key ** in
73
66
``%kernel.project_dir%/config/secrets/encryption_%kernel.environment%.key ``
74
67
75
68
.. note ::
76
69
77
- In order to use Symfony's built-in Secret storage, you will need the
70
+ In order to use Symfony's built-in secret storage, you will need the
78
71
`libsodium `_ PHP extension or use the `sodium_compat `_ package.
79
72
80
73
Symfony generates a key with a symetrics algorithm, meaning that this key could
@@ -83,41 +76,41 @@ possess this key should be as small as possible.
83
76
84
77
.. caution ::
85
78
86
- This file is sensitive and **must not ** be commited nor publicly shared. Every
87
- developpers and CI don't need that key. If the encryption key have been
88
- exposed (ex-employee leaving for instance)you should consider regenerating a
89
- new one.
79
+ This file is sensitive and **must not ** be commited nor publicly shared.
80
+ Every developpers and CI don't need that key. If the ** encryption key **
81
+ have been exposed (ex-employee leaving for instance), you should
82
+ consider regenerating a new one.
90
83
91
84
.. _secrets-add :
92
85
93
86
Create a Secret
94
87
---------------
95
88
96
- Once the `` encryption key `` generated, you can add new secret with the command
97
- ``secrets:add ``. Symfony'll ask you to enter the text to encrypt and generate
98
- a new file contains the ciphered text in a file stored by default in the folder
99
- %kernel.project_dir%/config/secrets/%kernel.environment%/. This file should be
100
- commited allongside the other project's files.
89
+ Once the ** encryption key ** generated, you can add new secret with the command
90
+ ``secrets:add ``. Symfony will ask you to enter the secret to encrypt and
91
+ generate a new file containing the encrypted secret in a file stored by default
92
+ in the folder `` %kernel.project_dir%/config/secrets/%kernel.environment%/ ``.
93
+ This file should be commited along side the other project's files.
101
94
102
95
.. code-block :: terminal
103
96
104
97
$ APP_ENV=prod php bin/console secrets:add DATABASE_PASSWORD
105
98
106
99
.. tip ::
107
100
108
- If the `` encryption key `` is compromized, you can regenerate a new key with
109
- the command ``secrets:generate-key ``. Symfony will decrypt the previous
110
- secret with the old key, adn re-encrypt theme with the new one.
101
+ If the ** encryption key ** is compromized, you can regenerate a new key with
102
+ the command ``secrets:generate-key ``. Symfony will decrypt previous secrets
103
+ with the old key, and re-encrypt them with the new one.
111
104
112
105
.. _secrets-reference :
113
106
114
107
Referencing Secrets in Configuration Files
115
108
------------------------------------------
116
109
117
- You can reference those secrets in any configuration option enclosing their
118
- names using the `` secret `` :ref: `environment variable processors <env-var-processors >`.
110
+ You can reference the secrets in any configuration option enclosing their names
111
+ using the ** secret ** :ref: `environment variable processors <env-var-processors >`.
119
112
Their actual values will be resolved at runtime (once per request), so that
120
- container compilation and cache warmup don't need the `` encryption key `` .
113
+ container compilation and cache warmup don't need the ** encryption key ** .
121
114
122
115
.. configuration-block ::
123
116
@@ -159,11 +152,11 @@ container compilation and cache warmup don't need the ``encryption key``.
159
152
]
160
153
]);
161
154
162
- This bellow configuration requires that every environment use secrets. each
163
- environment would have it own `` encryption key `` and encŷpted secrets.
155
+ This configuration requires that all environments uses secrets. Each
156
+ environment would have its own ** encryption key ** and encrypted secrets.
164
157
165
- You can also use parameters to configure diffrent strategy per environnement:
166
- By defining a default plaintext secret:
158
+ You can also use parameters to configure different strategies per environnement:
159
+ By defining a default plain text secret:
167
160
168
161
.. configuration-block ::
169
162
@@ -213,7 +206,7 @@ By defining a default plaintext secret:
213
206
]);
214
207
$container->setParameter('database_password', 'not a secret');
215
208
216
- Then overriding it in production environement :
209
+ Then overriding it in production environment :
217
210
218
211
.. configuration-block ::
219
212
@@ -251,27 +244,27 @@ Then overriding it in production environement:
251
244
List existing secrets
252
245
---------------------
253
246
254
- Every body is allowed to list the secret's name with the command ``secrets:list ``.
255
- If you have the `` encryption key `` you can also reveal the plain text value by
256
- passing the optoin ``--reveal `` to the command
247
+ Everybody is allowed to list the secret's name with the command ``secrets:list ``.
248
+ If you have the ** encryption key ** you can also reveal the secret value by
249
+ passing the option ``--reveal `` to the command
257
250
258
251
.. code-block :: terminal
259
252
260
253
$ APP_ENV=prod php bin/console secrets:list --reveal
261
254
262
255
------------------- ------------------
263
- key plaintext secret
256
+ key secret
264
257
------------------- ------------------
265
258
DATABASE_PASSWORD my-secret
266
259
------------------- ------------------
267
260
268
261
.. _secrets-deploy
269
262
270
- Deploy secret to production
271
- ---------------------------
263
+ Deploy secrets to production
264
+ ----------------------------
272
265
273
- As the `` encryption key `` is not commited, during development, you'll have to
274
- manualy deploy the key (once for a will ) at the path referenced in the
266
+ As the ** encryption key ** is not commited, during development, you'll have to
267
+ manualy deploy the key (once and for all ) at the path referenced in the
275
268
``encryption_key `` configuration key. Default is ``%kernel.project_dir%/config/secrets/%kernel.environment% ``.
276
269
277
270
.. _secrets-custom-storage
0 commit comments