Mitigating Hardcoded Secrets

Welcome to the second lesson of the "Cryptographic Failures" course! In our previous lesson, we explored the importance of cryptography and identified common cryptographic vulnerabilities. Today, we'll focus on a specific issue: hardcoded secrets in source code. Hardcoded secrets, such as API keys and encryption keys, pose significant security risks.

If these secrets are exposed, they can lead to unauthorized access and data breaches. Let's dive into understanding these risks and how to mitigate them effectively. 🔍

Hardcoded secrets are sensitive information embedded directly in the source code. Understanding the risks associated with hardcoded secrets is crucial for maintaining secure applications. Key examples include:

• Authentication credentials: Passwords, API keys, OAuth tokens.
• Cryptographic material: Encryption keys, JWT signing secrets.
• Connection strings: Database credentials, server access information.

These secrets are often added for convenience during development but can lead to severe security vulnerabilities if not managed properly.

For instance, in 2019, a major data breach occurred when hardcoded AWS keys were discovered in a public GitHub repository, leading to unauthorized access to sensitive data. To better illustrate this vulnerability, let's examine a concrete example of vulnerable code.

Let's examine a code snippet that demonstrates how hardcoded secrets can be a security risk in a Spring Boot application:

package com.codesignal.pastebin.util;

import org.springframework.stereotype.Component;
import javax.crypto.Cipher;
import javax.crypto.spec.IvParameterSpec;
import javax.crypto.spec.SecretKeySpec;
import java.nio.charset.StandardCharsets;
import java.security.MessageDigest;
import java.security.SecureRandom;
import java.util.Arrays;
import java.util.HexFormat;

@Component
public class EncryptionUtil {
    private final SecretKeySpec secretKey;
    private static final String ALGORITHM = "AES/CBC/PKCS5Padding";

    // Vulnerable: Secret key is hardcoded directly in the source code.
    public EncryptionUtil() {
        // NOTE: This is an example of vulnerable code - never use hardcoded secrets in production!
        String HARDCODED_SECRET = "my-super-secret-encryption-key-789"; // Hardcoded secret
        this.secretKey = generateKey(HARDCODED_SECRET);
    }

    private SecretKeySpec generateKey(String secret) {
        try {
            byte[] key = secret.getBytes(StandardCharsets.UTF_8);
            MessageDigest sha = MessageDigest.getInstance("SHA-256");
            key = sha.digest(key);
            key = Arrays.copyOf(key, 32);
            return new SecretKeySpec(key, "AES");
        } catch (Exception e) {
            throw new RuntimeException("Error generating encryption key", e);
        }
    }

    public String encryptSensitiveData(String data) {
        try {
            byte[] iv = new byte[16];
            SecureRandom random = new SecureRandom();
            random.nextBytes(iv);
            IvParameterSpec ivSpec = new IvParameterSpec(iv);

            Cipher cipher = Cipher.getInstance(ALGORITHM);
            cipher.init(Cipher.ENCRYPT_MODE, secretKey, ivSpec);
            byte[] encrypted = cipher.doFinal(data.getBytes(StandardCharsets.UTF_8));

            byte[] combined = new byte[iv.length + encrypted.length];
            System.arraycopy(iv, 0, combined, 0, iv.length);
            System.arraycopy(encrypted, 0, combined, iv.length, encrypted.length);

            return HexFormat.of().formatHex(combined);
        } catch (Exception e) {
            throw new RuntimeException("Error encrypting data", e);
        }
    }
}

In this code, the encryption key is hardcoded in the constructor, making it vulnerable to exposure. This Spring Boot component is designed to encrypt sensitive user data using the AES-256-CBC algorithm. The method encryptSensitiveData takes a String input, encrypts it, and returns the encrypted data in hexadecimal format.

If the source code is leaked or accessed by unauthorized individuals, they can easily extract this encryption key and decrypt sensitive data.

To mitigate the risks associated with hardcoded secrets, it's essential to refactor your code to use Spring Boot's property system instead. This approach keeps sensitive information out of your source code and in configuration files that can be properly secured.

Let's walk through the process of refactoring the code step by step, starting with using Spring's @Value annotation.

First, we need to inject the encryption secret from application properties using Spring's @Value annotation:

// Secure: Encryption secret is loaded from application properties
public EncryptionUtil(@Value("${app.encryption.secret}") String secret) {
    this.secretKey = generateKey(secret);
}

The @Value annotation is a Spring-specific feature that injects property values at runtime. The syntax "${app.encryption.secret}" tells Spring to look for a property named app.encryption.secret in the application's configuration files (such as application.yml or application-secrets.yml). This approach separates configuration from code, making it easier to manage different secrets across environments.

With Spring's property injection in place, we can now properly configure our application properties.

Next, we set up our configuration files to store the secrets. Spring Boot supports a hierarchical configuration system where you can have a main configuration file and additional files for sensitive data:

# application.yml - Main configuration (committed to version control)
server:
  port: 3001

spring:
  config:
    import: optional:classpath:application-secrets.yml

app:
  encryption:
    secret: ${ENCRYPTION_SECRET:default-encryption-secret}

This configuration uses Spring Boot's property override system. The ${ENCRYPTION_SECRET:default-encryption-secret} syntax means:

• First, try to use the ENCRYPTION_SECRET environment variable
• If not found, use the value from application-secrets.yml
• If still not found, fall back to default-encryption-secret (which should only be used for development)

Now create a separate file for sensitive secrets:

# application-secrets.yml - Sensitive configuration (NOT committed to version control)
# NOTE: Replace with your actual secret - this is just an example placeholder
app:
  encryption:
    secret: your-secret-key-here

The spring.config.import: optional:classpath:application-secrets.yml line tells Spring Boot to import the secrets file if it exists. The optional: prefix means the application will still start even if this file is missing, allowing it to fall back to environment variables or default values.

With our secrets now in configuration files, we can update our encryption function.

Now the encryption function uses the property-based secret to encrypt data:

public String encryptSensitiveData(String data) {
    try {
        byte[] iv = new byte[16];
        SecureRandom random = new SecureRandom();
        random.nextBytes(iv);
        IvParameterSpec ivSpec = new IvParameterSpec(iv);

        Cipher cipher = Cipher.getInstance(ALGORITHM);
        cipher.init(Cipher.ENCRYPT_MODE, secretKey, ivSpec);
        byte[] encrypted = cipher.doFinal(data.getBytes(StandardCharsets.UTF_8));

        byte[] combined = new byte[iv.length + encrypted.length];
        System.arraycopy(iv, 0, combined, 0, iv.length);
        System.arraycopy(encrypted, 0, combined, iv.length, encrypted.length);

        return HexFormat.of().formatHex(combined);
    } catch (Exception e) {
        throw new RuntimeException("Error encrypting data", e);
    }
}

This function now uses the encryption key from the application properties to encrypt data, ensuring that sensitive information is protected even if the source code is accessed by unauthorized individuals. Spring Boot automatically injects the configured value when creating this component.

However, our work isn't complete yet - we need to ensure our configuration files containing secrets remain secure by preventing them from being committed to version control.

To ensure your sensitive configuration remains secure, you need to prevent files containing secrets from being committed to your version control system. Create or update your .gitignore file to exclude the secrets file:

# Create or edit .gitignore file
echo "application-secrets.yml" >> .gitignore

This adds the secrets configuration file to your .gitignore, which tells Git to ignore this file when committing changes. This is crucial because:

1. It prevents sensitive information from being exposed in your repository.
2. It allows different developers to use different configuration values.
3. It enables different environments (development, staging, production) to have different settings.
4. It reduces the risk of accidentally committing secrets to version control.

You should also create a template file with dummy values to show other developers what configuration they need to set up:

# application-secrets.yml.example
# Copy this file to application-secrets.yml and update with your actual secrets
app:
  encryption:
    secret: your-encryption-secret-here

By following these steps, you've successfully eliminated the vulnerability of hardcoded secrets in your Spring Boot application.

In this lesson, we explored the risks associated with hardcoded secrets in source code and learned how to identify and mitigate these vulnerabilities. By using environment variables and properly configuring your version control system, you can securely manage sensitive information and protect your applications from unauthorized access.

As you move on to the practice exercises, apply what you've learned to reinforce these concepts. In the next lesson, we'll continue to build on this foundation, further enhancing your understanding of web application security. Keep up the great work! 🎉