SD11.3 · LESSON 3 OF 6

Transport and secrets

Place authentication, object authorization and resource limits at explicit application boundaries.

THE IDEA

Transport and secrets

Encryption protects data on selected paths or at rest. Secrets management covers credentials and their lifecycle: issue, store, rotate, revoke, and keep them out of code and logs. And neither answers the permission question: HTTPS tells you the channel is private, not that this caller may read this record.

GET /health 200 login ok api_key=sk-test-1234abcd POST /pay 201 password=hunter2 rejected ← two lines hold reusable credentials

key age (days) — policy: rotate within 90100

rotation OVERDUE HTTPS encrypts the connection. It does not say who the caller is allowed to be: ownership still needs an authorization check on each request, and secrets still need a lifecycle (issue, store, rotate, revoke).

Turn redaction on; slide the key age.

Predict first. Does HTTPS establish that a caller owns the requested record?

Chapter context

A distributed application must identify callers and control which resources and effects they may access. Tenant boundaries and resource budgets must be enforced by trusted components rather than inferred from client-supplied identifiers.

TRY IT YOURSELF

Part 1. Do it hands-on

Find leaked credentials by hand, then write a detector, a redactor and a rotation check.

GET /health 200 login ok api_key=sk-test-1234abcd POST /pay 201 password=hunter2 rejected ← two lines hold reusable credentials

key age (days) — policy: rotate within 90100

log lines with credentials 100-day-old key overdue? (yes/no) HTTPS proves ownership? (yes/no) encryption replaces authorization? (yes/no)

To do: A log has 4 lines: "GET /health 200", "login ok api_key=sk-test-1234abcd", "POST /pay 201", "password=hunter2 rejected". How many lines contain a credential that must not be logged?
To do: Policy: rotate a key at most 90 days after issue. A key is 100 days old. Is rotation overdue? Type yes or no
To do: Does HTTPS establish that a caller owns the requested record? Type yes or no
To do: Does encrypted transport remove the need for an authorization check on each request? Type yes or no

Part 2. Do it in code

contains_secret(line): True if the line matches (case-insensitive) a pattern like api_key=VALUE, api-key: VALUE, secret=..., password=..., token=..., or contains a value starting with "sk-" followed by at least 8 letters/digits/hyphens.
redact(line): replace the VALUE of those patterns (and any sk-… value) with "[redacted]", keeping the field name.
secret_lines(lines): the number of lines for which contains_secret is true.
rotation_due(issued_day, today, max_age_days): today − issued_day > max_age_days.
https_proves_ownership(): always False.
needs_authorization(over_https): always True — encryption in transit does not replace a permission check.

import re

def contains_secret(line):
    pass

def redact(line):
    pass

def secret_lines(lines):
    pass

def rotation_due(issued_day, today, max_age_days):
    pass

def https_proves_ownership():
    pass

def needs_authorization(over_https):
    pass

Ctrl/⌘ + Enter runs it

Stuck, or something not working? You can come back to it any time.

CHECK YOUR UNDERSTANDING

Does HTTPS establish that a caller owns the requested record?

ANoBYes

Chapter reference: math, worked example & code

This section belongs to the whole chapter, so it is the same on every lesson in it and may cover a different lesson's topic. The code for the experiment you just ran is inside the experiment itself.

Math and notation

For a token bucket with capacity C, refill rate r, previous tokens b and elapsed time dt:

b'=\min(C,b+r\,dt).

Accept cost k only when $b'\ge k$ , then subtract k atomically. Clock behavior, concurrency and shared enforcement are additional implementation requirements.

Worked example

A bucket holds at most 10 tokens and refills 2/s. An 8-token request at time zero leaves 2. Two seconds later it has 6. A request costing 7 is denied and leaves 6; a request costing 6 is accepted and leaves zero. Rejected operations should not accidentally create negative credit under this contract.

Reference code

The following example uses the Python standard library and does not call a remote service.

capacity,rate,tokens=10,2,10
tokens-=8
assert tokens == 2
tokens=min(capacity,tokens+rate*2)
assert tokens == 6
assert tokens < 7
assert tokens >= 6
tokens-=6
assert tokens == 0

Python examples are provided for study and local execution; this page does not execute Python.

Common mistakes

Authentication is not object-level authorization. Cache and worker paths can cross tenant boundaries too. A global rate limit requires a stated distributed enforcement contract.