zeripath 544ef7d394 Encrypt migration credentials at rest (#15895) (#16187) ...

Backport #15895

Storing these credentials is a liability.

* Encrypt credentials with SECRET_KEY before persisting to task queue table (they need to be persisted due to the nature of the task queue)
  - security in depth: helps when attacker has access to DB only, but not app.ini
* Delete all credentials (even encrypted) from the task table, once the migration is done, for safety
  - security in depth: minimizes leaked data if attacker gains access to snapshot of both DB and app.ini

2021-06-17 22:59:28 +02:00

1.5 KiB

Raw Blame History

View Raw