How to store encrypted password in an environment variable in node.js?

Viewed 710

So the idea is simple but I am not sure if I am doing it correctly. In my application, I need to use a username/password for some database connections. The information is stored in my .bashrc file and exports, env vars. I dont want to store them in clear text so I want to store them encrypted. At runtime, I read the env variables, decrypt them and use them.

What I currently have is an node.js application that does the encryption, code snippet:

    const crypto = require('crypto');

    const emailPassword = CLEAR_TEXT_PASSWORD;
    const algorithm = 'aes-192-cbc';
    const password = 'p3241';
    const key = crypto.scryptSync(password, 'salt', 24);
    const iv = Buffer.alloc(16, 0); 

    const cipher = crypto.createCipheriv(algorithm, key, iv);

    let encrypted = cipher.update(emailPassword, 'utf8', 'hex');
    encrypted += cipher.final('hex');
    console.log(encrypted);

The result of the above becomes my env variable.

Now in my consumer application, to use the env variable, I have a reverse routine from decryption before usage.

It looks like

export const decipher = (input: string) : string => {
    const algorithm = 'aes-192-cbc';
    const password = 'p3241';

    const key = crypto.scryptSync(password, 'salt', 24);


    const iv = Buffer.alloc(16, 0); 

    const decipher = crypto.createDecipheriv(algorithm, key, iv);

    let decrypted = decipher.update(input, 'hex', 'utf8');
    decrypted += decipher.final('utf8');
    console.log(decrypted);
    return decrypted;
}

but what I don't is all the parameters for encrypt/decrypt are in clear text in my code on the server.

Is there a better way of doing this or am I overly paranoid?

0 Answers
Related