Forum Discussion

robertmetcalf's avatar
robertmetcalf
Occasional Visitor
8 years ago

How can I stop property values being saved in XML files?

I have a process where I call an auth service to get credentials.

I then put the credentials into the header of further service calls.

The problem is when I save my project xml the credentials are there for all to see. We are using source control to share the projects and I don't want the credentials appearing here.

 

I know that I can pass in passwords from the command line and I am doing this, however the credentials are then retrieved by calling the auth service. I then have to use Transfer to assign the output of one to a property which is referenced elsewhere.

 

  • Nastya_Khovrina's avatar
    Nastya_Khovrina
    Icon for Alumni rankAlumni
    8 years ago

    Hi Robert,

     

    Thank you for your post!
    Unfortunately, we currently do not have a way to encrypt passwords in the project file. There are multiple feature requests surrounding this topic that our developers are planning to implement.

    For now, in case of a non-composite project, we recommend that you encrypt the project file for security reasons. 

     

    For your case, our developer has come up with a good example work flow that you can use to avoid having the credentials in the project file, to begin with. I have attached the example project and file for you to look at.

     

    You would have a credentials.txt file that is ignored (not uploaded) to Git. This file will have Username and pw on two separate lines.

     

    The project will then parse the file and set the TestCase properties to these values (look at "Parse crendentials.txt and set Properties" groovy test step).

     

    Now using Property Expansion, you can reference these values the Auth or form fields of a request.
    https://www.screencast.com/t/L5F0Bgd2
    https://www.screencast.com/t/xlsqWeX7xz3D

    At the end of the Test Case run the project will clear the TestCase properties through a teardown script.
    https://www.screencast.com/t/kxGg2qfdEks

    So with this workflow, each user will maintain their own credentials file and the project file will not have any stored credentials.