You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@trafficcontrol.apache.org by GitBox <gi...@apache.org> on 2022/04/05 20:10:06 UTC
[GitHub] [trafficcontrol] shamrickus opened a new issue, #6723: Traffic Ops Golang does not Properly Support Multiple Mojo Secrets
shamrickus opened a new issue, #6723:
URL: https://github.com/apache/trafficcontrol/issues/6723
<!--
************ STOP!! ************
If this issue identifies a security vulnerability, DO NOT submit it! Instead, contact
the Apache Traffic Control Security Team at security@trafficcontrol.apache.org and follow the
guidelines at https://apache.org/security regarding vulnerability disclosure.
- For *SUPPORT QUESTIONS*, use the #traffic-control channel on the ASF slack (https://s.apache.org/tc-slack-request)
or the Traffic Control Users mailing list (send an email to users-subscribe@trafficcontrol.apache.org to subscribe).
- Before submitting, please **SEARCH GITHUB** for a similar issue or PR
* https://github.com/apache/trafficcontrol/issues
* https://github.com/apache/trafficcontrol/pulls
-->
<!-- Do not submit security vulnerabilities or support requests here - see above -->
## This Bug Report affects these Traffic Control components:
<!-- delete all those that don't apply -->
- Traffic Ops
## Current behavior:
[Traffic Ops Perl used](https://github.com/apache/trafficcontrol/blob/4fa2f35231831b406b6d9fcdaa6690b6da368aac/traffic_ops/app/lib/TrafficOps.pm#L522) to have the ability to have multiple secrets, specifically for mojo cookies. When converting to TO golang, this functionality was lost.
The specific behavior is specified [here](https://metacpan.org/pod/Mojolicious#secrets)
<!-- Describe how the bug happens -->
## Expected behavior:
As an operator I should be able to prepend a secret to the TO `cdn.conf` which would make it so new cookies are made using the first secret, but all secrets can still be used for verification.
<!-- Describe what the behavior would be without the bug -->
## Steps to reproduce:
Login to TO, store the mojo cookie.
Modify `cdn.conf.[].secrets` to have a new entry (must be prepended)
Try to login to TO using the old cookie which will fail.
<!-- If the current behavior is a bug, please provide the *STEPS TO REPRODUCE* and
include the applicable TC version.
-->
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@trafficcontrol.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [trafficcontrol] ocket8888 commented on issue #6723: Traffic Ops Golang does not Properly Support Multiple Mojo Secrets
Posted by GitBox <gi...@apache.org>.
ocket8888 commented on issue #6723:
URL: https://github.com/apache/trafficcontrol/issues/6723#issuecomment-1089381314
I believe we dropped that on purpose, but it was before my time.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@trafficcontrol.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org