I have a SaaS application in which users can connect their RDBMS (postgres, mysql etc) and query data from it. I'm wondering what's the best practice to keep their connection details safe. Currently, I'm saving them to my application db (postgres) in plain text.
Maybe I can encrypt them?
Eventually, I'd like to achieve SOC2 compliance too.
Well, this a complicated and fascinating subject, Secret Management. Consider secrets to be any type of credential: usernames and passwords, keys, tokens, AES keys, MFA seeds, or the 12 (recovery) words of crypto wallets and, why not, connections strings too.
Try keeping this data secure for 99% of its lifetime.
In this specific case, the first thing to do ASAP is encrypt the credentials.
@Christophe's answer suggests the well-known pattern of comparing hashes instead of credentials in raw format. The problem is that hashes are not reversible. We lose the credentials, hence the capacity to create new connection strings.
Consider PosgreSQL's built-in encryption capabilities. They support at-rest and in transit encryption.
As for the in-memory security. The techniques depend on the stack, but some are quite generic. For example: don't store secrets in immutable types, nullify variables referencing secrets, or don't retain secrets in memory longer than necessary (no caches).
Never ever store passwords in plaintext, because :
A better way of managing passwords is to avoid knowing them:
OWASP guidance recommends to prefer having over simple encryption, because the possibility to decrypt does not prevent the risk of leakage.
If you need to use the password to establish a connection to third party on behalf of your users (and the users accept to record their password in your service and allow you to use it), then the hash code will not work and you'll indeed need to encrypt. To avoid being a source of weakness, you could however consider using some token based authentication, e.g. OAuth 2 which allows the user to establish the authorisation without you having to store any passwords.
