AWS logo
Amazon CodeGuruDetector Library

Hardcoded credentials Critical

Hardcoded credentials can be intercepted by malicious actors. Even after removing them from the code, they may still pose a risk because an attacker might have recorded them to use them at a later point in time.

Detector ID
javascript/hardcoded-credentials@v1.0
Category
Common Weakness Enumeration (CWE) external icon

Noncompliant example

1var crypto = require('crypto')
2function hardcodedCredentialsNoncompliant(salt, iterations, keyLen, digest) {
3    // Noncompliant: password is hardcoded.
4    crypto.pbkdf2('password', salt, iterations, keyLen, digest, (err, key) => {
5        if (err) {
6            throw err
7        }
8        return key.toString('base64')
9    })
10}

Compliant example

1var crypto = require('crypto')
2function hardcodedCredentialsCompliant(salt, iterations, keyLen, digest) {
3    // Compliant: password is obtained from environment.
4    crypto.pbkdf2(process.env.password, salt, iterations, keyLen, digest, (err, key) => {
5        if (err) {
6            throw err
7        }
8        return key.toString('base64')
9    })
10}