Develop Reference

How to secure API Keys in Environment Variables in a Vue CLI 4 and Electron project

I'm trying to develop a desktop app which would need to make a few private API calls, authenticated using some secret keys.
The keys are created for me by external IT service providers outside of my organisation - they are responsible for the security so there are a few constraints:
They said even though they have already taken steps on their end to secure the API and there are mitigation strategies in place even if a breach happens, but still they would like to make sure that I treat the keys with a security-conscious mindset and take whatever steps possible on my end as well to make sure they remain secured.
I'm not allowed to just create random middleware / gateway on a private server or serverless platform to perform the API calls on my app's behalf as these calls may contain business data.
I have done some research and from what I can find, the general recommendation is to set up a ".env" file in the project folder and use environment variables in that file to store the API keys.
But upon reading the Vue CLI documentation I found the following:
WARNING
Do not store any secrets (such as private API keys) in your app!
Environment variables are embedded into the build, meaning anyone can
view them by inspecting your app's files.
So, given the constraints, is there a way to store these keys securely in a Vue CLI 4 + Electron Desktop app project?
Thanks.

In general, especially if you have a lot of environment variables, it would be better practice to store environment variables in a dot env file (.env), however, it's possible that this file could be leaked when you package your electron app. So, in this case it would be better to store your environment variables from the terminal/command line. To do so follow this guide (https://www.electronjs.org/docs/api/environment-variables).
Keep in mind anything that requires the API key/private information try to keep it on the backend, i.e., the electron process and send the results to the Vue front end.
Here's an example of how you could implement this:
On windows from CMD:
set SOME_SECRET="a cool secret"
On POSIX:
$ export SOME_SECRET="a cool secret"
Main process:
// Other electron logic
const { ipcMain } = require("electron");
// Listen for an event sent from the client to do something with the secret
ipcMain.on("doSomethingOnTheBackend", (event, data) => {
API.post("https://example.com/some/api/endpoint", {token: process.env.SOME_SECRET, data});
});
Client side:
const { ipcRenderer } = require("electron");
ipcRenderer.send("doSomethingOnTheBackend", {username: "test", password: "some password"});
Also note, to use the ipcRenderer on the client side nodeIntegration needs to be enabled.
Here are some more resources to help you get started:
https://www.electronjs.org/docs/api/ipc-renderer
https://www.electronjs.org/docs/api/ipc-main

Firebase deploy: Missing expected firebase config value databaseURL

I'm trying to deploy my first function with firebase cloud functions.
I deployed the standard function "helloWorld" without problem, but then, when I added this:
const admin = require("firebase-admin");
admin.initializeApp();
firebase deploy didn't work anymore and caused this error:
Missing expected firebase config value databaseURL, config is actually{"projectId":"PROJECT-ID","storageBucket":"PROJECT-ID.appspot.com","locationId":"europe-west"}
If you are unit testing, please set process.env.FIREBASE_CONFIG
How can I set config or the value of databaseURL? I don't find anywhere the file where these things are written... I also looked in documentation but I didn't find anything useful
I tried also with
admin.initializeApp(process.env.FIREBASE_CONFIG);
but this give me this error:
Error: Error occurred while parsing your function triggers.
Error: Invalid Firebase app options passed as the first argument to initializeApp() for the app named "[DEFAULT]". Options must be a non-null object.

It looks like you're being affected by a change that was made a few months ago where the databaseURL is no longer auto-created when you create a new project.
If that is the case, you you can force the databaseURL to be generated by going to the Realtime Database panel in the Firebase console. If this indeed fixes the problem, it might be worth filing a bug report with the Firebase support team.

It looks like you don't have a default database created. Visit your firebase console and create at least one real-time database.
You can explicit select a database instance with functions.database.instance() View Docs

How can I parameterize a Firebase API call within a closure?

I'm using Firebase cloud functions to sync my Firestore db to a 3rd party db. Since my cloud functions use calls to a 3rd party API, I want to parameterize the api call as an input to use dependency injection while testing. The only way I can think of doing this is basically putting the cloud function within a regular function, i.e.,:
function foo(apiCall = api) {
exports.bar =
functions.firestore.document(doc_name).onCreate(snapshot => apiCall(snapshot));
return exports.bar
}
foo();
When I try to deploy with firebase deploy --only functions I'm told firebase doesn't see the functions as existing in the local source code.
I've additionally tried something like to no effect:
function foo(apiCall = api) {
return functions.firestore.document(doc_name).onCreate(snapshot => apiCall(snapshot));
}
exports.bar = foo();
When I put exports.bar outside of the function, it deploys fine.
This is my first time using Firebase so I'm not too familiar with the syntax and such, but I don't know why wrapping the cloud function with a regular function wouldn't work - any suggestions?

What you're trying to do isn't possible. The exports must be defined statically at the top level of index.js so that the CLI can find and deploy them. They can't be exported dynamically through a function.

Firebase function not fetching config variable

I'm trying to write a firebase function to send a transactional e-mail with SendGrid whenever it gets triggered by a HTTP request, but at the moment I'm having real difficulty getting the function to be able to access the configuration variables that I've set with the sendgrid key which is obviously a real problem...
I've set the config variable with the below command:
$ firebase functions:config:set sendgrid.key="KEY_HERE"
When I run firebase functions:config:get to list all the config values, it returns the correct value in the terminal:
{
"sendgrid": {
"key": "KEY_HERE"
}
}
But when I try to access it from my function (tried with both TypeScript & Vanilla JS setups), functions.config() just returns an empty object.
Has anyone encountered & solved this issue before, or am I doing something wrong? In either case, if anyone could give me a pointer then that'd be much appreciated!
Edit the first
I have deployed the function, and called it while hosted and looking at the logs, you can see the correct values. However, I still see the problem when I call the function when served locally on my machine for testing, which is a problem as I'd like to not have to deploy a function just to see if it works...

How to run a script on a newly created EC2 instance via AWS SDK?

I'm currently using AWS's Javascript SDK to launch custom EC2 instances and so far so good.
But now, I need these instances to be able to run some tasks when they are created, for example, clone a repo from Github, install a software stack and configure some services.
This is meant to emulate a similar behaviour I have for local virtual machine deployment. In this case, I run some provisioning scripts with Ansible that get the job done.
For my use case, which would be the best option amongst AWS's different services to achieve this using AWS's Javascript SDK?
Is there anyway I could maybe have a template script to which I passed along some runtime obtained variables to execute some tasks in the instance I just created? I read about user-data but I can't figure out how that wraps with AWS's SDK. Also, it doesn't seem to be customisable.
At the end of the day, I think I need a way to use the SDK to do this:
"On the newly created instance, run this script that is stored in such place, replacing these
placeholder values in the script with these I'm giving you now"
Any hints?

As Mark B. stated, UserData is the way to go for executing commands on instance launch. As you tagged the question with javascript here's an example on passing this in the ec2.runInstances command:
let AWS = require('aws-sdk')
let ec2 = new AWS.EC2({region: 'YOUR_REGION'})
// Example commands to create a folder, a file and delete it
let commands = [
'#!/usr/bin/env bash',
'mkdir /home/ubuntu/test',
'touch /home/ubuntu/test/examplefile',
'rm -rf /home/ubuntu/test'
];
let params = {
...YOUR PARAMS HERE...
UserData: new Buffer(commands.join("\n")).toString('base64')
}
// You need to encode it with Base64 for it to be executed by the userdata interpreter
ec2.runInstances(params).promise().then(res => { console.log(res); })

When you launch the new instances you can provide the user-data at that time, in the same AWS SDK/API call. That's the best place to put any server initialization code.
The only other way to kick off a script on the instance via the SDK is via the SSM service's Run Command feature. But that requires the instance to already have the AWS SSM agent installed. This is great for remote server administration, but user-data is more appropriate for initializing an instance on first boot.