Question

A Python service authenticates to a Cisco IOS-XE device controller using OAuth2 and receives a short-lived bearer token. During a security review, a colleague notices the token is written to a file named token.cache in the working directory so it can be reused across script runs, and the file has world-readable permissions. The service runs continuously as a long-lived daemon. Which change best aligns with secure coding practices for authentication and secret management while preserving functionality?

Accepted Answer

Keep the token in memory for the lifetime of the daemon, refresh it before expiry using the refresh flow, and never persist it to disk.

Answer

Continue caching the token in token.cache but change the file permissions to 0644 so only the intended users can read it.

Answer

Base64-encode the token before writing it to token.cache to obscure its value from casual inspection.

Answer

Hardcode a long-lived static API key in the source code instead of using OAuth2 tokens to avoid the caching problem entirely.