Search for a command to run...
Miguel is a Principal Engineer and the author of the “Serverless Security” book. He has worked on multiple serverless projects as a developer and security engineer, contributed to open-source serverless projects, and worked on large military systems in various engineering roles.
No comments yet. Be the first to comment.
Protect your system from vulnerabilities
How I saved my company $1 million
This YouTube video series provides quick overviews of the top 10 cybersecurity risks for serverless applications. Each video covers the risk and some recommendations on how to address it. Why is the OWASP Serverless Top 10 important? In this video, I...
![Overview of the OWASP Serverless Top 10 [videos]](/_next/image?url=https%3A%2F%2Fcdn.hashnode.com%2Fres%2Fhashnode%2Fimage%2Fupload%2Fv1636408504092%2FBcNttK9q2.png&w=3840&q=75)
A little over one year ago, I published my first book thanks to Apress and author Nihad Hassan. I am in a cybersecurity writing group with Nihad, where he shared he had published his 4th book; this was back in 2019. I was impressed by his accomplishm...
You may have heard, “If you build it, they will come.” Have you heard, “If you build it, I will break it?” This is a skill I developed over my career to build better systems. It is a skill that took me a while to learn I had. Shortly before I graduat...
Miguel's Blog · Serverless · Security
49 posts
Miguel A. Calles is the author of the Serverless Security book, and a Cybersecurity engineer who works on serverless and cloud computing projects.
In my previous article, we explored how to use cookies in Postman to store your secrets. Depending on your security requirements, you may need to use cryptography. This is where CryptoJS can help.
We can use a local Node.js script with the CryptoJS library to encrypt the secret. The example below shows how we will encrypt an API key.
const CryptoJS = require('crypto-js');
const { API_KEY: apiKey, SECRET_KEY: secretKey } = process.env;
const encryptedText = CryptoJS.AES.encrypt(apiKey, secretKey).toString();
console.log('encryptedText:', encryptedText);
We set the API key and secret key (used to encrypt the API key) as environment variables. That way we do not hardcode data into our script.
We will store the secret key as a cookie to avoid sharing the value, and will store the encrypted API key as an environment variable.
We whitelist a cookie domain.
We create a cookie to store the secret key.
We create an environment variable that has the encrypted API key.
We create a pre-request script to get the secret key from the cookie, decrypt the encrypted API key from the environment variable, and set a temporary variable (Postman Sessions) with the plaintext API key.
// https://postman-quick-reference-guide.readthedocs.io/en/latest/libraries.html
const cookieJar = pm.cookies.jar();
const sessionVarName = "xApiKey";
const cookieName = "secretKey";
const domain = "postman.galaxy.demo";
cookieJar.get(domain, cookieName, (error, secretKey) => {
if (error) {
console.error(error);
pm.variables.set(sessionVarName, "error");
}
if (secretKey) {
// decryption
console.log('secretKey', secretKey);
const xApiKeyEnc = pm.environment.get('x-api-key-enc');
console.log('xApiKeyEnc', xApiKeyEnc);
const xApiKey = CryptoJS.AES.decrypt(xApiKeyEnc, secretKey).toString(CryptoJS.enc.Utf8);
console.log('xApiKey', xApiKey);
pm.variables.set(sessionVarName, xApiKey);
} else {
console.error("Cookie is missing")
pm.variables.set(sessionVarName, "missing");
}
});
We write a test to explicitly delete the xApiKey variable after the request completes.
pm.variables.unset("xApiKey");
We can use the xApiKey variable to use the plaintext API key.
By using cookies, we can use a secret key while avoiding sharing it. By using CryptoJS, we can store encrypted data in an environment variable, decrypt it, and use the plaintext (i.e., decrypted) data only during the request execution.
Photo by Food Photographer | Jennifer Pallian on Unsplash