Credentials security vulnerability

[Colin]

@E1cid

You can access it, yes, it would be useless if you could not

It can be displayed in a debug node, and can be read from there.

[TotallyInformation]

@jbudd

it does not seem to reveal my $BankAccount credential flow variable.

I think that is because it isn't a real environment variable but rather a node-red construct. Where Node-RED allows you to access it using the same node-red mechanism.

process.env on the other hand does read the OS's environment variables out of system memory.

Though it probably only knows about the ones that existed when the current process started? Not sure, I haven't checked that but it would make sense.

[jbudd]

@E1cid

You can not export it in a flow

That is the key benefit of using an environment variable, of whatever type.

@E1cid

It can not be seen in the env config.

I suppose that's a slight benefit, at least if you have read-only dashboard users who can't deploy flow changes.

[E1cid]

You are repeating what @jbudd said above.

@jbudd
Anything can be read in editor here is my flows_cred.json decrypted by node-red, I am not going to show how but anything can be hacked if you have access to the editor, node-red is a powerful tool.