Encrypt sensitive data when sending to the server

xet7 · October 11, 2024, 7:11pm

1) Mongo Auto Field Encryption Package

2) Environment variables

API keys and other passwords are usually set as environment variables, that are only serverside. For example, here is adding some new environment variables at various platforms:

If there is some need to copy some environment variable to clientside, it’s possible by setting public variable:

github.com/wekan/wekan

server/header-login.js

main

import { Meteor } from 'meteor/meteor';
import { Accounts } from 'meteor/accounts-base';
import { WebApp } from 'meteor/webapp';
import {
  findOrCreateHeaderLoginUser,
  isTrustedHeaderLoginSource,
  shouldProcessHeaderLoginMiddlewareRequest,
} from '/server/lib/headerLoginAuth';

async function issueLoginTokenCookies(userId, req, res) {
  if (!userId) {
    return;
  }

  const stampedToken = Accounts._generateStampedLoginToken();
  const hashedToken = Accounts._hashStampedToken(stampedToken);
  const tokenExpires = Accounts._tokenExpiration(stampedToken.when);

  await Meteor.users.updateAsync(
    { _id: userId },

This file has been truncated. show original

Or if that environment variable is only needed serverside, it can stay at environment varible, or copied to private variable like Meteor.settings.headerLoginId .

API keys are usually needed to exist unencrypted at serverside.

3) User accounts

For user accounts, Meteor accounts packages save password in hashed format to database.

Before showing any sensitive data, it’s useful to check is user logged in:

if (Meteor.user()) {
...
}

4) Admin Panel

If at Admin Panel UI it’s needed to save some new password to database, it’s useful to just save it, for example with Meteor Method, but not load it back, not adding it to PubSub minimongo content.