Problem/Motivation

Currently, the feeds_http_oauth module stores OAuth 2.0 credentials (Client ID, Client Secret, Username, and Password) directly within the feed configuration as plain text. While this is functional, it presents several security risks and management challenges:

  1. Plaintext Storage: Secrets are stored in the database and exported via configuration as plain text, making them vulnerable if the database or configuration exports are compromised.
  2. Hardcoded Secrets: Users are forced to enter sensitive information directly into the UI, which may be visible to other administrators.
  3. Lack of Centralization: Updating a secret (e.g., rotating a Client Secret) requires editing every individual feed instance that uses it, rather than updating it in one central location.

Proposed resolution

Integrate the module with the Key module to leverage Drupal's standard for secure credential management.

  1. Dependency: Add key as a module dependency in feeds_http_oauth.info.yml.
  2. Plugin Refactor: Update HttpOAuthFetcher.php to use Dependency Injection to access the key.repository service.
  3. Secure UI: Update the HttpOAuthFetcherFeedForm.php to replace standard text and password fields with the key_select element. This allows users to select a pre-defined Key instead of typing secret values.
  4. Runtime Retrieval: Modify the token acquisition logic to fetch the real values from the Key module only at the moment of the request.

Remaining tasks

Review and testing.

User interface changes

The text fields for Client ID, Client Secret, Username, and Password in the OAuth 2.0 settings are replaced with dropdown menus that list available keys from the Key module.

Comments

qusai taha created an issue. See original summary.

qusai taha’s picture

Status: Active » Needs review
StatusFileSize
new10.83 KB
qusai taha’s picture

StatusFileSize
new12.83 KB
qusai taha’s picture

qusai taha’s picture

StatusFileSize
new12.83 KB
qusai taha’s picture

jnicola’s picture

Okay, so I have added your other two patches on issues and now the most recent patche doesn't apply. Re-roll a patch, let's make this happen. It seems sensible and since key allows saving to configuration folks can't complain that this breaks anything.

jnicola’s picture

Status: Needs review » Needs work
qusai taha’s picture

StatusFileSize
new11.11 KB

I have re-rolled the patch to ensure it works with the new development version—please have a look.

I believe the module is now ready for a stable release. If possible, could you proceed with publishing a stable version, as we have started using it across multiple websites?

qusai taha’s picture

qusai taha’s picture

Status: Needs work » Needs review
jnicola’s picture

I'll be testing this out today and assuming it all checks out I think an alpha release makes the most sense.

If we get some more adoption or your sites and mine hold up for a year we can call it stable.

  • 8ac6d5ca committed on 1.0.x
    feat: #3578504 Integrate with Key module for secure storage of OAuth 2.0...
jnicola’s picture

Status: Needs review » Fixed

Okay, implemented your patch, followed the message from the "Be sure to update the contribution record" as well so you should be attributed here.

Message me if we need to make any other adjustments to this module. I'm going to go tag an alpha release for this right meow.

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.

qusai taha’s picture

Thank you so much for the alpha release, this is great! I’m happy to see it.
Please feel free to reach out if there are any features we can work on to improve, and I’ll also keep you posted from my side.

jnicola’s picture

Status: Fixed » Closed (fixed)