Okta Keys
ID |
okta_keys |
Severity |
high |
Vendor |
Okta |
Family |
API Token |
Description
Okta is an identity and access management company. It provides cloud software that helps companies manage and secure user authentication into applications, and for developers to build identity controls into applications, website web services and devices.
Applications that use Okta for authentication can be set and associated to a user account, they are attributed a client_id and a client_secret to authenticate communications between the applications and Okta.
Security
Any hardcoded Okta Key is a potential secret reported by this detector.
Accidentally checking-in the keys to source control repositories could compromise your Okta account.
Suspicious activity could be detected by checking the logs on the platform.
Mitigation / Fix
-
Remove the
Keyfrom the source code or committed configuration file. -
Follow your policy for handling leaked secrets, which typically require revoking the secret in the target system(s). Secret revocation can be handled from your Application/General tab of the dashboard.
-
If under a git repository, you may remove unwanted files from the repository history using tools like
git filter-repoorBFG Repo-Cleaner. You may follow the procedure listed here for GitHub.
|
You should consider any sensitive data in commits with secrets as compromised. Remember that secrets may be removed from history in your projects, but not in other users' cloned or forked repositories. |