Skip to content

Security: Implement token encryption for file-based storage #34

@knowlen

Description

@knowlen

Description

As identified in PR #32 review, the current file-based token storage implementation uses proper file permissions but lacks encryption at rest. This could be enhanced for better security.

Current State

  • Tokens are stored in plain JSON files (.esologs_token.json)
  • File permissions provide basic protection
  • No encryption at rest

Proposed Solution

  1. Add optional encryption using the cryptography library
  2. Integrate with OS keychains using the keyring library
  3. Provide configuration option to enable/disable encryption
  4. Maintain backward compatibility with existing token files

Implementation Ideas

# Optional encryption wrapper
class EncryptedTokenStorage:
    def __init__(self, key_source='environment'):
        self.cipher = self._initialize_cipher(key_source)
    
    def save_token(self, token, filepath):
        encrypted_data = self.cipher.encrypt(json.dumps(token))
        # Save encrypted data
    
    def load_token(self, filepath):
        # Load and decrypt

Benefits

  • Enhanced security for stored credentials
  • Compliance with security best practices
  • Optional feature maintains simplicity for development

Considerations

  • Should be opt-in to avoid breaking existing workflows
  • Clear documentation on key management
  • Performance impact should be minimal

References

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions