Security best practices strongly suggest keeping secrets out of codebases and filesystems. Commerce Vantiv should support and suggest keeping API credentials out of config files and in environment variables.

Comments

steveoliver created an issue. See original summary.

  • steveoliver committed 94ee609 on 8.x-1.x 
    Issue #2858594 by steveoliver: Support and suggest API credentials out...
steveoliver’s picture

steveoliver commented
Status: Active » Fixed

  • steveoliver committed 99c9f5b on 8.x-1.x 
    Issue #2858594 by steveoliver: Override getConfiguration() instead of...
steveoliver’s picture

steveoliver commented
Status: Fixed » Needs work

Values currently end up in config on settings save. We should make sure they stay out if set in ENV vars.

  • steveoliver committed fe12591 on 8.x-1.x 
    Issue #2858594 by steveoliver: Keep environment variables out of...
steveoliver’s picture

steveoliver commented
Status: Needs work » Fixed

That should do it.

  • steveoliver committed e51fbd0 on 8.x-1.x 
    Issue #2858594 by steveoliver: Use secure configuration in payment...

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.