Forums

What securty best-pratice is recommended for runtime storage of passwords and tokens to third party services (email, socialmedia)?

I imagine the flow as follows:

1. Username Password SecureStorage (!!! What happens here)
2. runtime unlocks the SecureStorage (!!! What happens here)
3. (python) export username password from storage
4. send authentication http requests
5. dispose of variables that store the password

Constraints:

• All actions performed in same OS session
• Runtime will not have in code or memory of Secure-Storage unlock key
• Preferable that the os user in which the script runs already has access to a file or folder, which is not accessible by any other method externally.
• will considerer using methods for storing salt values

Found this as a possible solution option

Glad to hear that you found solution to your problem.

Has anyone solved this problem on the pythonanywhere platform? or is there a recommendation for storing secrets that is specific to pythonanywhere?

We do not have specific recommendations. Use what works for you.