{"action":"created","issue":{"url":"https://api.github.com/repos/lucadegasperi/oauth2-server-laravel/issues/407","labels_url":"https://api.github.com/repos/lucadegasperi/oauth2-server-laravel/issues/407/labels{/name}","comments_url":"https://api.github.com/repos/lucadegasperi/oauth2-server-laravel/issues/407/comments","events_url":"https://api.github.com/repos/lucadegasperi/oauth2-server-laravel/issues/407/events","html_url":"https://github.com/lucadegasperi/oauth2-server-laravel/issues/407","id":81420460,"number":407,"title":"Security of stored credentials (access tokens, refresh tokens, client secrets)","user":{"login":"spronkey","id":430712,"avatar_url":"https://avatars.githubusercontent.com/u/430712?v=3","gravatar_id":"","url":"https://api.github.com/users/spronkey","html_url":"https://github.com/spronkey","followers_url":"https://api.github.com/users/spronkey/followers","following_url":"https://api.github.com/users/spronkey/following{/other_user}","gists_url":"https://api.github.com/users/spronkey/gists{/gist_id}","starred_url":"https://api.github.com/users/spronkey/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/spronkey/subscriptions","organizations_url":"https://api.github.com/users/spronkey/orgs","repos_url":"https://api.github.com/users/spronkey/repos","events_url":"https://api.github.com/users/spronkey/events{/privacy}","received_events_url":"https://api.github.com/users/spronkey/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-05-27T12:01:29Z","updated_at":"2015-07-01T23:49:22Z","closed_at":null,"body":"As per http://tools.ietf.org/html/rfc6819#section-5.1.4.1.3, access tokens, refresh tokens, and client secrets should be stored securely where possible.\r\n\r\nCurrently, with these credentials stored in plaintext, it removes defense in depth. Plenty of scenarios, such as sql injections, rogue employees, insecured database access, would allow any attacker a much easier way to gain access to an access token and control your API.\r\n\r\nAre there any reasons why we can't hash, or at least symmetrically encrypt the tokens stored in the database?"},"comment":{"url":"https://api.github.com/repos/lucadegasperi/oauth2-server-laravel/issues/comments/117854595","html_url":"https://github.com/lucadegasperi/oauth2-server-laravel/issues/407#issuecomment-117854595","issue_url":"https://api.github.com/repos/lucadegasperi/oauth2-server-laravel/issues/407","id":117854595,"user":{"login":"kielabokkie","id":1221750,"avatar_url":"https://avatars.githubusercontent.com/u/1221750?v=3","gravatar_id":"","url":"https://api.github.com/users/kielabokkie","html_url":"https://github.com/kielabokkie","followers_url":"https://api.github.com/users/kielabokkie/followers","following_url":"https://api.github.com/users/kielabokkie/following{/other_user}","gists_url":"https://api.github.com/users/kielabokkie/gists{/gist_id}","starred_url":"https://api.github.com/users/kielabokkie/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kielabokkie/subscriptions","organizations_url":"https://api.github.com/users/kielabokkie/orgs","repos_url":"https://api.github.com/users/kielabokkie/repos","events_url":"https://api.github.com/users/kielabokkie/events{/privacy}","received_events_url":"https://api.github.com/users/kielabokkie/received_events","type":"User","site_admin":false},"created_at":"2015-07-01T23:49:21Z","updated_at":"2015-07-01T23:49:21Z","body":"I'm also interested to know if this is something that might get implemented at some point"}}