Session files store auth credentials in plaintext

[themavik]

sessions.py stores auth.raw_auth (which can contain passwords and tokens) directly in the session JSON file under ~/.config/httpie/sessions/. post_process_data only handles cookies and headers but leaves the auth block as-is.

Anyone with read access to the user's config directory can extract credentials from session files.

[attoba]

Hi! I explored this issue and i’m considering integrating OS-level secure storage via Python keyring:

• Store credentials in keyring
• Store only a reference in session file
• Keep backward compatibility with existing sessions

Would this direction be acceptable?

[dp1620]

Hey @themavik ,

The security risk of storing credentials in plaintext session files is eliminated by Voiden's Git-Native, file-centric architecture. We don't use opaque session files; all requests are stored in .void files directly in your repository, allowing you to manage security and version control using standard Git processes.

For actual secrets, Voiden uses .env support. This ensures you define authentication strategies once and reference them everywhere, keeping sensitive credentials out of committed files entirely.

As one of the maintainers, I invite you to check out our open-source repo: https://github.com/VoidenHQ/voiden.