How should I handle configuration and secrets in Redis?

Question

Configuration must be available to the application without exposing credentials in source control, logs or browser code. What belongs in the runtime and which access controls matter?

Tasadduq Burney · Accepted Answer

Keep Redis on a restricted network, use ACLs and enable TLS where supported. Give applications only the commands and key patterns they need. Do not expose an unauthenticated server publicly, and avoid logging connection URLs that include passwords.

How should I handle configuration and secrets in Redis?

1 answer

Your perspective belongs here.

0 question comments