In search of a secure and flexible solution for storing credentials in a config file for database connections and other private information within a Python module. This module is responsible for logging user activity in the system through different handlers (mongodb, mysqldb, files, etc).
The challenge lies in loading the config file for each handler within the logging module. Parameters such as database connection details, username, password, table names, etc., need to be loaded dynamically.
After conducting research on the web and Stack Overflow, I found discussions mainly focusing on the security risks associated with using Json and CPickle. However, my concern is more about the method used to store the config file rather than the comparison between these methods.
I'm curious about whether storing credentials in a .json file poses security risks, especially when this file is located on the server and accessible by the logging handler. The possibility of retrieving this information through an HTTP request raises some concerns. On the other hand, keeping parameters within a Python object in a .py code may enhance security since any request to access this data would first go through the server. However, this approach sacrifices modularity and easy modification of the data.
What recommendations do you have for addressing security issues related to storing config files on the server and accessing them through Python classes? Your input would be greatly appreciated.