使用 Puppeteer 保存网页抓取密码的最安全方法是什么？

Question

I'm trying to scrape a website that needs login. The code snippet below works by saving username and password in a config JSON file. If someone gets access to the config file, the login information will be leaked out. Is there a better way to enhance security, say encrypting the username and password? Thanks in advance!

await page.goto("https://www.facebook.com/", { waitUntil: "networkidle0" });
await page.type("#email", config.username, { delay: 30 });
await page.type("#pass", config.password, { delay: 30 });

Answer 1

Option 1: JWT

You can use something like Json Web Token to encrypt data (And store it). The "problem" with JWT is you need a token to encrypt/decrypt the data and that token have to be in a safe location (You mind, maybe). So, everytime you start the server, you need to give it the token.

// Encrypt
let data = {username: 'ciro-gomes', password: 'Dá bilhão?'};
var encrypted = jwt.sign(data, 'my random token');
// Store encrypted data

// Decrypt
var data = jwt.verify(encrypted, 'my random token');
// data = {username: 'ciro-gomes', password: 'Dá bilhão?'}

---

Option 2: Use tokens provided by the website

Normally, after login, the website gives you some cookies which are used to authenticate the user during the next access (Without asking for password). You should store these cookies and, when needed, restore them to Puppeteer.
Of curse someone could use this data to access the website, but it is an website's issue. Normally, when the user try to access important stuff, the website ask the password to be safe.

Answer 2

By the very fact you store the password locally and send it out later means that you either assume the machine it is being done on is "100% secure" (or secure enough, for your purposes), or that you don't care much about that password. Encrypting the config file will only work if you encrypt it using something isn't stored on that machine, but then you'll have to provide that something every time you run that script.

You can, obviously, obfuscate it one way or another, but it will NEVER be secure.