I am developing a Google Workspace Addon (standalone script) which will make REST API calls to external service and for that purpose it needs to provide an API key.
I request the API key input from a user and then store it in PropertiesService in the following way:
function onSheets(e) {
const userProperties = PropertiesService.getUserProperties();
const saved_api_key = userProperties.getProperty('api_key');
const api_key: string = saved_api_key ? saved_api_key : "";
const builder = CardService.newCardBuilder();
const apiKeyInput = CardService.newTextInput().setTitle('API Key')
.setFieldName('api_key')
.setHint('Enter your API Key')
.setValue(api_key);
const saveApiKey = CardService.newAction().setFunctionName('saveApiKeyFn');
const button = CardService.newTextButton().setText('Save').setOnClickAction(saveApiKey);
const optionsSection = CardService.newCardSection()
.addWidget(apiKeyInput)
.addWidget(button)
builder.addSection(optionsSection);
return builder.build();
}
function saveApiKeyFn(e) {
const api_key = e.formInput.api_key;
const userProperties = PropertiesService.getUserProperties();
userProperties.setProperty('api_key', api_key);
return CardService.newActionResponseBuilder()
.setNotification(CardService.newNotification()
.setText("API Key saved"))
.build();
}
Since userProperties are scoped to a current user it seems fine. But I have serveral problems with this solution:
Is this really safe? I mean it is stored in plain text so maybe there are ways to retrive it by other mailcious user?
The idea that by mistake I would use getScriptProperties() and thus leak one user's API key to all other users gives me nightmares. It is highly sensitive API key. It would cost a user tons of money if abused.
I read that some user's suggest https://cloud.google.com/secret-manager but I am not sure it's fit for this particular scenario. It would require one more external API call. It is not free. And lastly from what I underestand I would be sort of an owner of all of these secrets since I will be the owner of the Google Cloud project in which this API runs.
All I want is for the users to be able to store their keys safely, so that no one else including me can never access them.
What would you suggest? Thanks!
Is this really safe? I mean it is stored in plain text so maybe there are ways to retrive it by other mailcious user?
Security is relative. There's no such thing as absolute secrecy. Here are some attack scenarios:
Google employees or support may have unrestricted access
If a particular user installed a trigger, that trigger runs as that user and other users, if they can trigger the script and have edit access to the script, will be able to access the keys. A common scenario would be a installed edit trigger in a sheet. User B can access user A, if he can make a edit as well as edit the script. As mentioned in the comments by doubleunary, this is less of a problem in a published add on, as the source code is not accessible or editable.
Encrypting keys is a possibility. But, where would you store the decrypting key? You could ask every user to have a custom password for decrypting the key. But how many times are you going to make a API call? Would they have to enter the key every time? At what point does convenience overtake the need for secrecy?
The idea that by mistake I would use getScriptProperties() and thus leak one user's API key to all other users gives me nightmares. It is highly sensitive API key. It would cost a user tons of money if abused.
That is a possibility, but one that's easily avoidable by careful code review by yourself and your peers.
Those are the scenarios I could think of.
Related:
Securely Storing API Secrets used in Google Apps Script - Published Library
Firebase ID token has invalid signature
Hi all, I'm somehow new to NodeJS and I've only used Google Firebase a few times.
Now, I'm trying to verify an idToken generated using getIdToken() method whenever a user signs up or signs in. The token generation works fine but if I try to use this token to authorize a user admin.auth().verifyIdToken(idToken) on another route, I get this error Firebase ID token has invalid signature on Postman. I tried to verify the token on jwt.io as well, it gave error Invalid Signature.
I tried switching to different algorithms, some eventually made the token valid on jwt, but there is usually a VERIFY SIGNATURE box by the bottom-right which I don't really know what to fill there. Well, I've tried copying different newly generated valid tokens by jwt after changing algorithm, but I still get Firebase ID token has invalid signature from Postman.
Does anyone know what the problem may be? Please help.
The problem comes from the Firebase Emulator Auth. The Firebase-hosted Auth is unable to verify JWT token generated by the Firebase Emulator Auth.
To verify the token manually on jwt.io, you need to grab one of the public keys from google: https://www.googleapis.com/robot/v1/metadata/x509/securetoken#system.gserviceaccount.com
To choose the correct key, find the one that corresponds to your kid from jwt.io.
Paste in the correct corresponding value and now your token should verify correctly (be sure to clear out any \n characters):
For easier programmatic verification, the "JWK URI" is https://www.googleapis.com/service_accounts/v1/jwk/securetoken#system.gserviceaccount.com
Source: https://firebase.google.com/docs/auth/admin/verify-id-tokens
For some reason, verifyIdToken function throws "Firebase ID token has invalid signature" each time for valid tokens when used in Firebase Emulator locally. I fixed this problem by starting using firebase hosted auth instead of emulator auth (remove auth property from firebase.json). Also, I reported the bug to Firebase.
I agree with Genius Hawlah's answer, the problem is the Firebase Emulator Auth. As a workaround I suggest to start emulators without the Auth one with the --only flag, for example firebase emulators:start --only firestore,functions, and authenticate with a user you have in the production Authentication
TLDR;
Prefer log from dart:developer over print and debugPrint.
I was not using the emulator...
I'm new to Firebase and have experienced this, and even upvoted GeniusHawlah's as Taras Mazurkevych's answers... But couldn't find anything in the Firebase setup related to the simulator that I did.
So it happened I was testing my firebase using a truncated JWT token, printed from Dart's debugPrint (which limits truncates output). I was successful in using log from dart:developer!
I was enlightened by https://github.com/flutter/flutter/issues/22665#issuecomment-456858672.
I encountered a similar problem, figured out that by BE was pointing to the local emulator, but FE was pointing to the remote Firebase Auth (because of a bug in the code firebase.auth().useEmulator(...) wasn't called)
As you can see in the source code, the firebase-admin package behaves differently when there is an Auth emulator available. You can either not start it to begin with or make it undiscoverable by removing its address from process.env.
delete process.env.FIREBASE_AUTH_EMULATOR_HOST
Source reference:
public verifyIdToken(idToken: string, checkRevoked = false): Promise<DecodedIdToken> {
const isEmulator = useEmulator();
return this.idTokenVerifier.verifyJWT(idToken, isEmulator)
.then((decodedIdToken: DecodedIdToken) => {
// Whether to check if the token was revoked.
if (checkRevoked || isEmulator) {
return this.verifyDecodedJWTNotRevokedOrDisabled(
decodedIdToken,
AuthClientErrorCode.ID_TOKEN_REVOKED);
}
return decodedIdToken;
});
}
emragins answer is great!
One thing which emragins wrote but it wasn't clear for me is that you need to copy the whole text between
-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----\n
and made replace("\n","").
The result from this operation you can paste to the JTW.io. VERIFY SIGNATURE field.
I am working with the Evernote Python SDK, and proceeding through the Oauth workflow description here.
http://dev.evernote.com/doc/articles/authentication.php
How do I get a oauth_token_secret? I have my consumer secret, but don't see how to get the oauth_token_secret.
To retrieve an access token, I believe I will need to use the "get_access_token" function. One of the required arguments there is the oauth_token_secret.
https://github.com/evernote/evernote-sdk-python/blob/master/lib/evernote/api/client.py
I have the other pieces required (oauth_token, oauth_verifier).
I think you can leave that blank.
https://discussion.evernote.com/topic/18710-access-token-secret-returning-blank/
I'm having trouble trying to send a POST message to an Azure SB Queue using PostMan.
The error I get is 401 40103: Invalid authorization token signature
My issue is generating the SAS as I'm trying to follow various articles and examples but I must be missing/overlooking/not understanding something.
If I describe what I've done, hopefully it'll become obvious where I'm making a mistake.
My Queue URL is https://GTRAzure.servicebus.windows.net/subscriptionpreference
My Policy is Submit
I've chosen an expiry date for December: 1512086400
My string-to-sign is https://gtrazure.servicebus.windows.net/subscriptionpreference\n1512086400 which is then encoded as https%3A%2F%2Fgtrazure.servicebus.windows.net%2Fsubscriptionpreference%5Cn1512086400
I then sign this using the Primary Key I get from the Submit policy. I'm using this to test: https://www.freeformatter.com/hmac-generator.html
This generates a code like 425d5ff8beb8da58e6f97e45462037e25ea56bcb63470f9b28761fa012f61090 using SHA-256 Which I then base-64 encode to get NDI1ZDVmZjhiZWI4ZGE1OGU2Zjk3ZTQ1NDYyMDM3ZTI1ZWE1NmJjYjYzNDcwZjliMjg3NjFmYTAxMmY2MTA5MA==
I then put it all together to get this which I place in the text of the Authorization header
SharedAccessSignature sig=NDI1ZDVmZjhiZWI4ZGE1OGU2Zjk3ZTQ1NDYyMDM3ZTI1ZWE1NmJjYjYzNDcwZjliMjg3NjFmYTAxMmY2MTA5MA==&se=1512086400&skn=Submit=&sr=https%3A%2F%2Fgtrazure.servicebus.windows.net%2Fsubscriptionpreference%5Cn1512086400
I think the string to sign which you are providing is incorrect because \n is not getting treated as new line which generates encoded value as :
https%3A%2F%2Fgtrazure.servicebus.windows.net%2Fsubscriptionpreference%5Cn1512086400
which gives Authorization failure.
But if it is treated as new line, it will give value like this:
https%3A%2F%2Fgtrazure.servicebus.windows.net%2Fsubscriptionpreference%0A1512086400
which will not give error.
I've written the beginnings of a nodejs app to receive webhook notifications from travis-ci. What I'm stuck on is the inability to match my constructed sha2 hash of my combined username/repostory plus my Travis user token. The first piece comes along in the Travis-Repo-Slug header and the second piece is in my profile/info page at travis-ci.org. Here's what my code looks like:
var hash = crypto.createHash('sha256').update(repoSlug + userToken).digest('hex');
The value of hash does not equal the value I find in the Authorization header as I would expect it to be:
if (hash == req.get('Authorization')) {
// authorized request
I've been following the documentation here http://docs.travis-ci.com/user/notifications/ but perhaps in staring at this all day I've missed something obvious. Does anyone have suggestions on what may be going on?
Figured this out... I realized my travis access key wasn't the one currently configured in the github repo's webhook configuration. Travis uses this one as part of its hash when talking to my webhook. Hope someone finds this useful :)