Search for a command to run...
Miguel is a Principal Engineer and the author of the “Serverless Security” book. He has worked on multiple serverless projects as a developer and security engineer, contributed to open-source serverless projects, and worked on large military systems in various engineering roles.
No comments yet. Be the first to comment.
Protect your system from vulnerabilities
How I saved my company $1 million
This YouTube video series provides quick overviews of the top 10 cybersecurity risks for serverless applications. Each video covers the risk and some recommendations on how to address it. Why is the OWASP Serverless Top 10 important? In this video, I...
![Overview of the OWASP Serverless Top 10 [videos]](/_next/image?url=https%3A%2F%2Fcdn.hashnode.com%2Fres%2Fhashnode%2Fimage%2Fupload%2Fv1636408504092%2FBcNttK9q2.png&w=3840&q=75)
A little over one year ago, I published my first book thanks to Apress and author Nihad Hassan. I am in a cybersecurity writing group with Nihad, where he shared he had published his 4th book; this was back in 2019. I was impressed by his accomplishm...
You may have heard, “If you build it, they will come.” Have you heard, “If you build it, I will break it?” This is a skill I developed over my career to build better systems. It is a skill that took me a while to learn I had. Shortly before I graduat...
Miguel's Blog · Serverless · Security
49 posts
Miguel A. Calles is the author of the Serverless Security book, and a Cybersecurity engineer who works on serverless and cloud computing projects.
Storing your secrets (e.g., API keys and passwords) in Postman environments might not meet your security requirements. Although they are stored at rest, they are accessible to every team member in plaintext. You can leverage Postman cookies as an alternative because they are local to the machine, the computer user, and the Postman desktop client.
You might be thinking, “Cookies are bad. They are also plain text.”
True. They are, but at least they are not stored in the Postman servers and accessible by every team member.
The Postman Sandbox supports the crypto-js package, which you can use to add more security to the cookie’s value.
Let’s explore how to use a Postman cookie. I’m not going to do the encryption for simplicity.
In your request, click the “Cookies” link.
The “Cookies” link is below the “Send” button in your request.
Whitelist a domain.
This link is located at the bottom-left of the Cookies dialog.
Use a fake domain.
Add a domain to your cookies.
Add the fake domain to your cookies.
Add a cookie.
Add a cookie to the fake domain.
You can now use the cookie’s value in your request.
Use a pre-request script to set a local variable. Local variables only apply to the request per the Postman documentation.
const cookieJar = pm.cookies.jar();
const cookieName = "apiKey"
cookieJar.get('my-secrets.com', cookieName, (error, cookie) => {
if (error) {
console.error(error);
pm.variables.set(cookieName, "error");
}
if (cookie) {
pm.variables.set(cookieName, cookie);
} else {
console.error("Cookie is missing")
pm.variables.set(cookieName, "missing");
}
});
The pre-request script code.
Use the variable in the request as usual. In this example, we will use the “apiKey” variable in the headers.
Setting the header using the variable containing the cookie’s value.
To be safe, make sure to clear the local variables. We will do this in the tests.
// clear just the variable
pm.variables.unset("apiKey")
// or clear all the local variables
pm.variables.clear()
Clearing the variable after the request.
The approach will allow you to use secrets in Postman without sharing them with the world.
Originally published on Medium.com
Photo by Christina Branco on Unsplash