- Issue created by @mxr576
I agree that they shouldn't be stored in plain text.
+1 for changing to a password field.
- First commit to issue fork.
Hi, I've put together a partial solution to this. It migrates existing API key data and utilizes the standard password field type as suggested.
I say partial, because I haven't addressed automatic key setup. I'm not entirely sure how we should approach this, because my implementation so far uses Drupal's notification system to provide the generated API key's value once before it is encrypted automatically. Delivering a new key might entail using email but I wasn't sure if that's the approach that should be taken. I'm open to suggestions.
Delivering a new key might entail using email but I wasn't sure if that's the approach that should be taken. I'm open to suggestions.
Email is definitely not a good approach. Stripe's website uses a modal, and once you close that modal, you won't see the full key again.
- First commit to issue fork.