Problem/Motivation
Currently, the feeds_http_oauth module stores OAuth 2.0 credentials (Client ID, Client Secret, Username, and Password) directly within the feed configuration as plain text. While this is functional, it presents several security risks and management challenges:
- Plaintext Storage: Secrets are stored in the database and exported via configuration as plain text, making them vulnerable if the database or configuration exports are compromised.
- Hardcoded Secrets: Users are forced to enter sensitive information directly into the UI, which may be visible to other administrators.
- Lack of Centralization: Updating a secret (e.g., rotating a Client Secret) requires editing every individual feed instance that uses it, rather than updating it in one central location.
Proposed resolution
Integrate the module with the Key module to leverage Drupal's standard for secure credential management.
- Dependency: Add key as a module dependency in
feeds_http_oauth.info.yml.
- Plugin Refactor: Update
HttpOAuthFetcher.php to use Dependency Injection to access the key.repository service.
- Secure UI: Update the
HttpOAuthFetcherFeedForm.php to replace standard text and password fields with the key_select element. This allows users to select a pre-defined Key instead of typing secret values.
- Runtime Retrieval: Modify the token acquisition logic to fetch the real values from the Key module only at the moment of the request.
Remaining tasks
Review and testing.
User interface changes
The text fields for Client ID, Client Secret, Username, and Password in the OAuth 2.0 settings are replaced with dropdown menus that list available keys from the Key module.
Comments
Comment #2
qusai taha commentedComment #3
qusai taha commentedFull patch to make it compatible with the issues reported here:
https://www.drupal.org/project/feeds_http_oauth/issues/3578495
and
https://www.drupal.org/project/feeds_http_oauth/issues/3576978
.
Comment #4
qusai taha commentedComment #5
qusai taha commentedComment #6
qusai taha commentedComment #7
jnicola commentedOkay, so I have added your other two patches on issues and now the most recent patche doesn't apply. Re-roll a patch, let's make this happen. It seems sensible and since key allows saving to configuration folks can't complain that this breaks anything.
Comment #8
jnicola commentedComment #9
qusai taha commentedI have re-rolled the patch to ensure it works with the new development version—please have a look.
I believe the module is now ready for a stable release. If possible, could you proceed with publishing a stable version, as we have started using it across multiple websites?
Comment #10
qusai taha commentedComment #11
qusai taha commentedComment #12
jnicola commentedI'll be testing this out today and assuming it all checks out I think an alpha release makes the most sense.
If we get some more adoption or your sites and mine hold up for a year we can call it stable.
Comment #14
jnicola commentedOkay, implemented your patch, followed the message from the "Be sure to update the contribution record" as well so you should be attributed here.
Message me if we need to make any other adjustments to this module. I'm going to go tag an alpha release for this right meow.
Comment #16
qusai taha commentedThank you so much for the alpha release, this is great! I’m happy to see it.
Please feel free to reach out if there are any features we can work on to improve, and I’ll also keep you posted from my side.
Comment #17
jnicola commented