Can I use WordPress Transients to store 'sensitive' data? For example login tokens or Captcha answers?

As far as I know all themes and plugins have access to transients. What would be another good way to store this kind of details?

Edit: The reason I ask this question is that I am creating a 2 Factor Authentication plugin that generates a login token. This token is sent via SMS or e-mail to the user. What would be a safe way to store this token.

  • "safe" from what whom and when? there is not really anything which is "just safe". Once you give any user some access he might be able to use some security issue to get the secret, the trick is to balance between functionality and security and not to worry about the NSA trying to break into a server, but about a more realistic threats. – Mark Kaplun Feb 19 '17 at 14:23
  • You're right. I have decided to use User Meta within WordPress to store those keys. – xvilo Feb 19 '17 at 22:18

Yes you can, transients is on your server, not accessible by front end client. You can use also update_option() https://codex.wordpress.org/Function_Reference/update_option

| improve this answer | |
  • Okay, so it is considered 'safe' if I would store a 2 Factor Auth sms code as a transient. I am not sure If would need to use my own database table or not. On the other hand. Any plugin or theme could expose the 2FA sms code via the transients API. – xvilo Feb 19 '17 at 13:02

No. Nothing in wordpress environment is isolated enough to be used as a safe place for keeping secrets. Any other code can use you code to get the data (therefor encrypting things will not help).

If it is a true secret, then store it as a cookie/local storage on the user's PC if you are trying to save the effort required from the user typing his password/token/whatever.

| improve this answer | |
  • The idea is that the token is being send via SMS. It wouldn't be any secure if the user could read the token :') – xvilo Feb 19 '17 at 13:33
  • Oh you are talking about doing DRM? it can never be done if a user can manipulate your code – Mark Kaplun Feb 19 '17 at 14:05
  • I have edited my question about why I was asking this. – xvilo Feb 19 '17 at 14:08
  • cookie/local storage? Really? It's the first advice on how to NOT store sensitive information. – Oksana Romaniv Sep 10 '19 at 6:34
  • @OksanaRomaniv why? what is more secure than not storing the info on the server at all? – Mark Kaplun Sep 11 '19 at 14:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.