Contentful Content Delivery API Key
ID |
contentful_content_delivery_apikey |
Severity |
high |
Vendor |
Contentful |
Family |
API Token |
Description
Contentful is a headless content management system where you can update the content of your website, a mobile app or any other platform that displays content.
The Content Delivery API (CDA), available at cdn.contentful.com, is a read-only API for delivering content from Contentful to apps, websites and other media. Content is delivered as JSON data, and images, videos and other media as files.
Security
Any hardcoded Contentful API Key is a potential secret reported by this detector.
Accidentally checking-in the key to source control repositories could compromise your Contentful account.
Examples
export const environment = {
// Contentful Credentials
contentfulspaceId: '7acnvc7n28re',
contentfultoken: 'cD1a432b69b041271b60fbb48110dac5d4066d8751c46ab96ce7opjkfiodsi8u',
}
Mitigation / Fix
-
Remove the
API Keyfrom the source code or committed configuration file. -
Follow your policy for handling leaked secrets, which typically require revoking the secret in the target system(s). To revoke an API Key go to your project Settings dashboard, and revoke the key from the ApiKeys section.
-
If under a git repository, you may remove unwanted files from the repository history using tools like
git filter-repoorBFG Repo-Cleaner. You may follow the procedure listed here for GitHub.
|
You should consider any sensitive data in commits with secrets as compromised. Remember that secrets may be removed from history in your projects, but not in other users' cloned or forked repositories. |