Secure Speech Service Key/Region

[hunterjam]

Motivation

Ensure sensitive credentials cannot be exposed. We are currently returning the Azure Speech Key from the /api/config endpoint in plain text

chat-with-your-data-solution-accelerator/code/app.py

Lines 32 to 40 in ede0d6d

	@app.route("/api/config", methods=["GET"])
	def get_config():
	# Return the configuration data as JSON
	return jsonify(
	{
	"azureSpeechKey": env_helper.AZURE_SPEECH_KEY,
	"azureSpeechRegion": env_helper.AZURE_SPEECH_SERVICE_REGION,
	}
	)

How would you feel if this feature request was implemented?

Requirements

• Stop returning the value of the Azure Speech Key from the /api/config endpoint. Consider using SecretStr from pydantic https://docs.pydantic.dev/2.6/examples/secrets/ to return a masked version of the secret
• Ensure that the speech service from the frontend is still functional (it calls the /api/config endpoint) Speech from UI does not work when using RBAC #501
• Stretch: Improve this endpoint to return the full config with all secrets masked

Tasks

To be filled in by the engineer picking up the issue

• Implement https://github.com/Azure-Samples/cognitive-services-speech-sdk/blob/master/samples/js/browser/README.md#token-exchange-process
• Return all config from /api/config, with secrets masked #683

[ross-p-smith]

The solution now has KeyVault - should this be utilised?

[adamdougal]

The solution now has KeyVault - should this be utilised?

Looks like we are now using Key Vault. I think this is more that the key is returned in plain text from the /api/config end point 😬

chat-with-your-data-solution-accelerator/code/app.py

Lines 32 to 40 in ede0d6d

	@app.route("/api/config", methods=["GET"])
	def get_config():
	# Return the configuration data as JSON
	return jsonify(
	{
	"azureSpeechKey": env_helper.AZURE_SPEECH_KEY,
	"azureSpeechRegion": env_helper.AZURE_SPEECH_SERVICE_REGION,
	}
	)

I'll reword the issue to be clearer.

[superhindupur]

https://github.com/Azure-Samples/cognitive-services-speech-sdk/blob/master/samples/js/browser/README.md#token-exchange-process can be relevant for this task

[cecheta]

After discussing with the team, it has been decided to remove the /api/config endpoint entirely, as there is no requirement for the endpoint, and to have the endpoint while also masking secrets is non-trivial.

If such a requirement arises, the endpoint may be added back to the application.