0Pricing
Edge Computing with Cloudflare Workers & Deno · 课时

安全的机密信息管理

学习在边缘环境中安全处理 API 密钥、令牌和其他敏感信息的最佳实践

安全的机密信息管理 是 CoddyKit 上的免费 Edge Computing with Cloudflare Workers & Deno 课时。 这是第 3 节课，共 4 节。 你可以在下方免费阅读本课时的完整内容 — 然后在浏览器中使用内置代码编辑器和全天候 AI 导师进行实践。 这是 Edge Computing with Cloudflare Workers & Deno 学习路径的一部分，你的进度在网页和 CoddyKit 应用中同步。 Edge Computing with Cloudflare Workers & Deno 课程共包含 4 节课。

本课时的部分内容尚未翻译，以英文显示。

What Are Edge Secrets?

When building applications, especially at the edge, you often need to handle sensitive information. These are called secrets.

Secrets include things like API keys, database credentials, authentication tokens, and private encryption keys. They are critical for your application's security and functionality.

Dangers of Hardcoding Secrets

A common mistake, especially for beginners, is to hardcode secrets directly into your application's source code.

  • Exposure: Anyone with access to your code (e.g., in a public Git repository) can see your secrets.
  • Rotation Issues: Changing a secret means changing and redeploying your code everywhere it's used.
  • Security Breach: A single leak can compromise your entire system.

Cloudflare Worker Environment Variables

Cloudflare Workers provide a secure way to manage secrets using environment variables. These variables are:

  • Injected securely at runtime, not stored in your code.
  • Encrypted at rest by Cloudflare.
  • Specific to each Worker, allowing fine-grained control.

They are accessed via the env object in your Worker's fetch handler.

Accessing Worker Secrets Demo

This Worker accesses an environment variable named MY_API_KEY. Notice how the secret itself is never hardcoded in the script.

Try running it! (The actual key won't be shown for security).

export default {
  async fetch(request, env, ctx) {
    const apiKey = env.MY_API_KEY; // Access the secret

    if (apiKey) {
      return new Response(`Secret accessed! Length: ${apiKey.length}`);
    } else {
      return new Response(
        "MY_API_KEY environment variable not set.",
        { status: 400 }
      );
    }
  },
};

Deno Environment Variables

Similar to Workers, Deno applications also use environment variables for secrets. You can access them using Deno.env.

For local development, you might use .env files (though not directly supported by Deno, tools like deno task or third-party modules can help). For Deno Deploy, secrets are configured securely through their platform UI or CLI.

Using Deno Secrets Demo

Here's a simple Deno script that retrieves a secret named DB_PASSWORD from its environment variables. Run this example to see it in action.

const dbPassword = Deno.env.get("DB_PASSWORD");

if (dbPassword) {
  console.log(`Database password accessed. Length: ${dbPassword.length}`);
} else {
  console.log("DB_PASSWORD environment variable not set.");
  console.log("To set: env DB_PASSWORD='mysecret' deno run --allow-env main.ts");
}

Managing Secrets with Wrangler CLI

For Cloudflare Workers, the Wrangler CLI is your go-to tool for managing secrets. It encrypts and securely uploads them to Cloudflare's infrastructure.

  • wrangler secret put <NAME>: Prompts for a secret value and uploads it.
  • wrangler secret delete <NAME>: Removes a secret.
  • wrangler secret list: Lists all secrets for your Worker.

This keeps secrets out of your wrangler.toml file and source code.

Principle of Least Privilege

A crucial security principle is the Principle of Least Privilege. This means:

  • Granting only the minimum necessary permissions to access resources.
  • Only giving access to secrets to the specific services or users that absolutely need them.

Avoid giving a Worker access to a secret it doesn't actually use, even if it seems convenient.

Secret Rotation and Auditing

Even with secure storage, secrets can be compromised. Implement these practices:

  • Secret Rotation: Regularly change your API keys and tokens (e.g., every 90 days). This limits the window of opportunity for attackers if a secret is leaked.
  • Auditing: Monitor and log access to your secrets. This helps detect unusual activity and potential breaches.

Automate these processes where possible to reduce manual overhead.

Secrets Management Check

Test your understanding of secure secrets management.

Recap: Secure Secrets

In this lesson, we learned about the importance of securely managing sensitive information in edge applications.

  • Never hardcode secrets.
  • Utilize platform-provided environment variables (Cloudflare Workers env, Deno Deno.env).
  • Use tools like Wrangler CLI for secure secret deployment.
  • Follow the Principle of Least Privilege.
  • Implement regular secret rotation and auditing.

These practices are fundamental to building robust and secure edge applications.

常见问题解答

「安全的机密信息管理」课时是免费的吗？

是的 — 「安全的机密信息管理」的完整文本可在网页上免费阅读。要进行交互式练习（内置代码编辑器和全天候 AI 导师）并解锁 Edge Computing with Cloudflare Workers & Deno 课程的其余内容，请升级到 CoddyKit PRO。 Edge Computing with Cloudflare Workers & Deno 课程共包含 4 节课。

「安全的机密信息管理」这节课中我会学到什么？

学习在边缘环境中安全处理 API 密钥、令牌和其他敏感信息的最佳实践 你通过在浏览器中直接运行的动手代码来练习 Edge Computing with Cloudflare Workers & Deno，全天候 AI 导师会在你学习这节课的过程中回答你的问题。

学习 Edge Computing with Cloudflare Workers & Deno 需要有经验吗？

无需任何先前经验。CoddyKit 上的 Edge Computing with Cloudflare Workers & Deno 课程适合初学者到高级学习者，你可以从这里开始或从头开始，按照自己的节奏学习。 这是第 3 节课，共 4 节。

「安全的机密信息管理」课时需要多长时间？

大多数 CoddyKit 课程大约需要 5–10 分钟。每节课都很精短且互动，所以你能稳步进步，并在网页和应用中从离开的地方继续。

我能在这节 Edge Computing with Cloudflare Workers & Deno 课中编写并运行代码吗？

能。每节 Edge Computing with Cloudflare Workers & Deno 课都包含内置代码编辑器，你可以在浏览器中直接编写并运行真实代码，并获得即时 AI 反馈 — 无需本地设置。

此课程中的所有课时

  1. 身份验证与授权
  2. 速率限制与 DDoS 防护
  3. 安全的机密信息管理
  4. 输入清理与注入防护
← 返回 Edge Computing with Cloudflare Workers & Deno