Support constants for api keys

[b-interactive]

Support constants for api keys

[B-Interactive]

This is just a clarification on what's being stored. The Cloudflare Global API Key is not collected, used or stored by the plugin (the original version did). The security concerns of handling the API Key with the plugin would be considerable, which is why I stepped away from that once I forked it.

Instead, what's stored is a generated API Token with limited scope (assuming the user has defined that limited scope to something like Stream:Edit), and client IP address filtering. In the event this API Token is maliciously obtained, the scope of exploit would be limited to Stream:Edit functions, and then only if executed from a permitted IP address.

In the interest of discussing the scenarios, and the possibility I'm missing something important, I'll step out the scenario as I've imagined it:

In theory, I could provide you with an API Token from my account in clear text, but that remains unusable by you, unless you're able to execute calls from the permitted IP address of my server. If you're able to execute calls from my server (as an unauthorised actor), then I would not be confident that other means of storing the API Token, such as environment variables, or secrets managers, would provide any advantage, because of the access you would have already gained in an unauthorised way.

[fului]

Hi @B-Interactive, I'm new to Cloudflare Stream, so I didn't know about the IP filtering, which probably helps a bit, but I am using the scoped key, which is why I found this plugin.

In my experience, some agencies will use an .env file for all their secrets and then load them via constants, which is why it would be nice to support.

Also, it is not unheard of that a 3rd-party plugin has had a security vulnerability where it was possible to run sql code and then a simple sql like the following would probably reveal a few api keys, as people tend to add api in the options name, myself included.

SELECT option_value FROM wp_options WHERE option_key LIKE %api%

This is not a pressing thing or a dealbreaker, but it would be a nice addition to the plugin and I don't think it would be super hard to implement.

Alternatively, a solution like this one could also be relevant.
https://fullstackdigital.io/blog/how-to-safely-store-api-keys-and-access-protected-external-apis-in-wordpress/