Purpose: To find a way to securely store google/facebook client id and secret in backend web server. I read that, I should not store client id and secret in web server.
Recommendation needed: What software or practice I can use to store client id and secret key for my web applications.
Addtional information: I have built a MERN application that authenticate user by google login and facebook login. In my code, backend server communicate with google and facebook authentication.
On a hosting platform which is not shared you probably have very few choices other than storing it on the server. However, it is normally best practice to store credentials in a separate file from your code (eg. a .env file).
When storing credentials in a Git (or other version control) repository these should not be in plain text.
For this I would recommend using Ansible, and Ansible Vault and combining it with you deployment.
If you are after a quick solution, you could always GPG encrypt your credentials and have them in a repository. A good guide for instructions on how to do this: https://www.cyberciti.biz/tips/linux-how-to-encrypt-and-decrypt-files-with-a-password.html
