ryandotsmith/l2met — pull request #98 by ryandotsmith (2013-08-12 18:44:49+00:00)
Title: Security Fix: Decrypt Librato Creds JIT.

Applies to all versions of l2met using the Redis store.

L2met makes HTTP requests to the Librato API on behalf of the
l2met user. L2met does not store the user's Librato credentials
in a long term database. When l2met receives an HTTP request containing
log data, it parses the authorization header, decrypts the header, and
extracts the librato username and password. L2met then keeps the username
and password assoicaited with the log data. This means that the Librato
username and password get passed through Redis on their way to the Librato
outlet and Librato API.

This patch keeps the username and password in their encrypted form
during the Redis phase of the data flow. HTTP requests sent to l2met
are decrypted, but the result is not cached. Instead, the encrypted data
is passed through the system. It is only at the time we make the Librato
HTTP request that we extract the Librato username & password.