The management of sensitive information in the configuration needs to avoid hard-coded and submission to version control. Recommended practices include: 1. Use environment variables to store sensitive information, local development of .env files and add .gitignore, and the production environment is injected through CI/CD or Kubernetes; 2. Divide the configuration structure into two parts: general configuration and sensitive configuration to ensure that sensitive information is not submitted; 3. Use encrypted configuration files such as SOPS or OpenSSL to encrypt configuration files, which are suitable for high security requirements scenarios; 4. Avoid common errors such as committing .env, hard-coded keys, log printing complete configuration, and lack of non-empty checks. It is recommended to add build check logic and ignore sensitive field output.

Managing sensitive information in configurations is an important part of developing secure applications, especially in languages ??like Go, where many projects read keys directly from environment variables or configuration files. If it is not handled properly, this information can easily be leaked. The key point is: it does not hard-code sensitive data in the code, nor does it submit it to version control .

Here are some practical practices that fit the actual situation of most Go projects.

Use environment variables to store sensitive information

This is the most common and recommended method. Go programs can load variables in .env files through os.Getenv("KEY") or using libraries like godotenv .

• During local development, you can use the .env file to easily set environment variables (remember to add this file to .gitignore ).
• In production environments, it is recommended to inject environment variables through CI/CD tools or container orchestration platforms such as Kubernetes.

For example:

 dbPassword := os.Getenv("DB_PASSWORD")
if dbPassword == "" {
    log.Fatal("missing DB_PASSWORD in environment")
}

This is not only safe, but also facilitates switching configurations in different environments.

Configuration structure separation of sensitive and non-sensitive content

It is a good habit to divide the configuration into two parts: one is a common and submissionable configuration (such as port number, log level), and the other is sensitive information (such as database password, API key).

For example:

 // config.go
type Config struct {
    Port int
    LogLevel string
}

// secrets.go (not committed)
type SecretConfig struct {
    DBUser string
    DBPassword string
}

This way, even if you share the configuration structure or submit it to a public repository, sensitive information will not be exposed.

Using Encrypted Configuration Files (Advanced)

If you have to use configuration files and want to further protect the content, you can consider using encrypted configuration files. Decrypt the program before running, and only plaintext data in memory is retained during running.

Common tools include:

• SOPS : supports multiple encryption methods (GPG, AWS KMS, etc.), and can save encrypted YAML/JSON files in Git.
• Custom script OpenSSL: Suitable for simple scenarios, but with slightly higher maintenance costs.

This type of solution is suitable for projects with high security requirements, such as financial systems or internal platforms.

Avoid common mistakes

Some practices may seem convenient, but they may easily cause problems:

• ? Submit .env to Git repository (especially public repository)
• ? Hard code the key in the code, such as const apiKey = "123456"
• ? Print the complete configuration structure in the log, resulting in unexpected key output
• ? Non-empty checks are performed on the environment variables, which makes it difficult to check for errors during runtime

suggestion:

• All sensitive files are added to .gitignore
• Add build check logic to ensure that necessary variables exist
• Avoid printing of sensitive fields in the log

Basically that's it. Go's ecology does not have much "magic" in this regard, it depends on good habits and clear structure. As long as you don't write the keys to death in the code, and then cooperate with environment variables or encryption methods, you can effectively reduce the risk.

The above is the detailed content of How to manage configuration secrets in Go. For more information, please follow other related articles on the PHP Chinese website!