ActiveRecord 将密码存储到供应商站点是否太过分了？
考虑这种情况。我们有一个内部 Rails 2 应用程序，它使用 Savon（Ruby SOAP 库）连接到供应商站点。连接依赖于使用用户名和密码的身份验证。密码每 30 天更改一次。现在 - 每隔 30 天，开发人员必须访问供应商的网站，更新密码，然后返回我们的内部 Rails 应用程序，更新密码，将应用程序推送到网络服务器并重新启动乘客。
我们将密码作为常量以及其他几个特定于网络的常量存储在环境文件中。我们有点想把这个责任交给客户服务经理，这样她每 30 天更新一次密码，进入应用程序中的一个小表格并更新密码。
存储该密码的最佳方式是什么？显然我们不能在环境文件中执行 CONSTANT 并不断重新加载应用程序。但与此同时，创建一个模型来将一个密码存储在单独的表中似乎有些过大，因为应用程序中向供应商站点发出请求的部分 - 每天执行大约 1000 个请求，并且需要非常快，这意味着每次发出请求时，将该密码存储在表中都需要进行额外的查询。当然，对于我们的体积来说，这不是什么大问题，但理论上，除了我们现在所做的（在应用程序启动时将其加载到内存中）之外，解决此问题的最佳\有效解决方案是什么？
Consider this scenario. We have an internal Rails 2 app that connects to a vendor site using Savon ( Ruby SOAP library). The connection relies on authentication using a username and password. Password changes every 30 days. Right now - every 30 days on of the developers has to go to vendor's site, update the password, and the go back to our internal rails app, update a password, push the app to the webserver and restart passenger.
We store the password as a CONSTANT in the environment file along with a couple of more constants, specific to the web. We kind of want to offload this responsibility to a customer service manager, so that she updates the password every 30 days, the go to a little form in the app and updates the password.
What is the best way to store that password? We obviously can't do the CONSTANT in an environment file and keep reloading the app. But at the same time creating a model to store one password in a separate table seems like an overkill, also since the part of the app that make a request to vendor site - does about 1000 requests per day, and needs to be pretty fast, that means that storing that password in a table requires an extra query every time the request is made. Of course for our volume it's not a big deal, but theoretically what is the best\efficient solution for this problem, other than doing what we do now, loading it into memory on app start?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
将（加密的）密码存储在平面文件中。通过信号重新加载文件，或者在身份验证失败时重新加载文件，或者自上次重新加载以来已经过去了 10 秒以上并且文件的时间戳已更改。将此逻辑包装到单个方法中，例如
.getCredentials()。大多数时候它只会返回缓存的登录名和密码值。对我来说，将其存储在适当的数据库中确实看起来有点过分了。
Store the (encrypted) password in a flat file. Reload the file by a signal, or on auth failure, or if more than 10 seconds passed since last reload and file's timestamp has changed. Wrap this logic into a single method like
.getCredentials(). Most of the time it will just return cached login and password values.Storing this in a proper database does look like an overkill to me.