Comments (2)
This is just a clarification on what's being stored. The Cloudflare Global API Key is not collected, used or stored by the plugin (the original version did). The security concerns of handling the API Key with the plugin would be considerable, which is why I stepped away from that once I forked it.
Instead, what's stored is a generated API Token with limited scope (assuming the user has defined that limited scope to something like Stream:Edit
), and client IP address filtering. In the event this API Token is maliciously obtained, the scope of exploit would be limited to Stream:Edit functions, and then only if executed from a permitted IP address.
In the interest of discussing the scenarios, and the possibility I'm missing something important, I'll step out the scenario as I've imagined it:
In theory, I could provide you with an API Token from my account in clear text, but that remains unusable by you, unless you're able to execute calls from the permitted IP address of my server. If you're able to execute calls from my server (as an unauthorised actor), then I would not be confident that other means of storing the API Token, such as environment variables, or secrets managers, would provide any advantage, because of the access you would have already gained in an unauthorised way.
from cloudflare-stream-wordpress.
Hi @B-Interactive, I'm new to Cloudflare Stream, so I didn't know about the IP filtering, which probably helps a bit, but I am using the scoped key, which is why I found this plugin.
In my experience, some agencies will use an .env
file for all their secrets and then load them via constants, which is why it would be nice to support.
Also, it is not unheard of that a 3rd-party plugin has had a security vulnerability where it was possible to run sql code and then a simple sql like the following would probably reveal a few api keys, as people tend to add api
in the options name, myself included.
SELECT option_value FROM wp_options WHERE option_key LIKE %api%
This is not a pressing thing or a dealbreaker, but it would be a nice addition to the plugin and I don't think it would be super hard to implement.
Alternatively, a solution like this one could also be relevant.
https://fullstackdigital.io/blog/how-to-safely-store-api-keys-and-access-protected-external-apis-in-wordpress/
from cloudflare-stream-wordpress.
Related Issues (20)
- Switch from zones to accounts API HOT 8
- Playback defaults in admin settings HOT 1
- Not all URL parameters work in iframe embed player HOT 5
- Admin CSS enqueued in wrong class.
- Deprecation of plugins use of zones API
- Preload behaviour for video embed HOT 2
- Unify rendering of block and shortcode
- Block editor doesn't preview videos requiring signed URLs HOT 5
- Plugin name / permalink slug currently conflicts with Cloudflare Stream HOT 1
- Update readme.txt
- WordPress plugin adoption HOT 7
- Add support for posters (cover photo) for signed url videos HOT 6
- Shotcode sizing issues HOT 7
- Refactor block to use functional components HOT 2
- Upgrade path for existing blocks HOT 3
- Update the block player to the new iframe player HOT 5
- Option for account specific sub-domains HOT 6
- Localization updates HOT 2
- Upload button is missing HOT 2
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from cloudflare-stream-wordpress.