posts/http-clients-secrets

[giscus[bot]]

posts/http-clients-secrets

https://www.techwatching.dev/posts/http-clients-secrets

[renaud-huillet]

Thank you for this article.
Why in the end storing the password instead of retrieving it each time ( less efficient but safer ) ?
Is there a way to use token instead and automate their rotation between the keyvault and the corresponding ressource ?
Cheers / merci !

[TechWatching]

Thank you for your message.

JetBrains HTTP Client and API Client tools in general do not have the capability of accessing a key vault or a secret manager each time they need it. They rely on secret files to store the secrets needed to make the API calls. So the whole purpose of the article is to generate such a file instead of sending it or sharing it insecurely. And that's this file that will contain sensitive information like a token, an access key, a password ....

Not sure I understood correctly the question about the token, but how you API client tool (Http Client for Rider, REST Client for vscode, Postman , ....) will be authorized to access your API depends on your API. So you could have a script that automate the token/secrets rotation in the keyvault.

[TechWatching]

By the way @renaud-huillet, Microsoft announced a preview of Visual Studio 2022 that has the built-in capability to retrieve secrets from Azure Key Vault. Pretty awesom https://devblogs.microsoft.com/visualstudio/safely-use-secrets-in-http-requests-in-visual-studio-2022/ !