Remove hard-coded auth key from config.js about tailwindtraders-backend HOT 6 CLOSED

Understood. I would still suggest removing as AuthKeys, no matter what they're for, should not be hard-coded.

from tailwindtraders-backend.

Hi!
This is the authkey used by the CosmosDB emulator (on Windows).
The assumption (should be docummented) here is that if AUTHKEY is not set is because you are using CosmosDb emulator.

Need to document how to develop on local machine using CosmosDb emulator and Docker or Visual Studio, because is not a easy setup.

Thanks! :)

from tailwindtraders-backend.

You're true on this.

Just pointing that, at least, this hardcoded key is not a security issue. But it can be easily handled through .env file on Backend site.

I'll keep this issue open until this is fixed!

from tailwindtraders-backend.

It's not a security issue for you, but for the customers that look at this and say "ah - here's a pattern we can follow", it becomes a security issue for them. It's super important we follow our own guidelines no matter how good we think our practices are - users look to our code and often will copy/paste, which is fine as that's why it's there.

from tailwindtraders-backend.

Hi @robconery
I've updated the code and added documentation about how to configure containers for running locally.

I leave the issue open, close it if this is OK.

from tailwindtraders-backend.

Fixed with commit d9bbee

from tailwindtraders-backend.