Security of postgresql pg.Pool connection pool credentials

Question

How to securely store postgresql pg.Pool connection pool credentials in a node.js implementation? After setting config object to pass to pg.Pool it is stored unencrypted in the Pool object, which means it is visible in memory at all times.

Does pg.Pool have a callback mechanism whereby it could call your function to decrypt on the fly only when it needs the credentials, or somehow secure it somewhere else other than storing it in the pool object, with the goal of keeping it out of memory for extended amounts of time in an unencrypted state?

Please advise.

Answer 1

Does pg.Pool have a callback mechanism whereby it could call your function to decrypt on the fly only when it needs the credentials

No such thing, because the connection details are meant strictly for the server-side.

You can only decrypt the connection just before creating the Pool object. After that it will be kept internally by the object.

In a corporate environment, your database server should simply reside within DMZ.