You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@trafficcontrol.apache.org by GitBox <gi...@apache.org> on 2021/12/02 23:35:19 UTC
[GitHub] [trafficcontrol] ocket8888 opened a new issue #6397: login tokens should be single-use
ocket8888 opened a new issue #6397:
URL: https://github.com/apache/trafficcontrol/issues/6397
## This Improvement request (usability, performance, tech debt, etc.) affects these Traffic Control components:
- Traffic Ops
## Current behavior:
If a user requests a password reset, a login token is generated for them. The token is never removed until the user actually changes his or her password. But successfully authenticating with a token grants a valid Mojolicious cookie which is refreshed on every subsequent successful request. So users choose to take advantage of this token and never change their password, so it sticks around for years. This is dangerous for two reasons:
1. Tokens are not encrypted at rest in the database, unlike passwords. Yet they are as powerful as passwords, so if a password needs to be encrypted at rest, then so does a token IMO.
2. unlike a password, which is only ever presented *by* the client *to* the server, a login token is sent *out* from the server over SMTP, as a part of a link in an email. Because the token is not single-use, and because the only way to remove it is by updating the user's password, _this is **exactly** equivalent to sending the user's unencrypted password via email, which you'd never do_.
## New behavior:
Tokens should be single-use. I know this "feature" is being used in production/testing/dev/demo environments (e.g. CDN-in-a-Box's "extension" user), but we now have OAuth support in TO (as of a couple years ago if memory serves), so if token-based authentication is desired, it can still be done. It's possibly difficult to switch, but I think it's worth it.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@trafficcontrol.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [trafficcontrol] asheikm commented on issue #6397: login tokens should be single-use
Posted by GitBox <gi...@apache.org>.
asheikm commented on issue #6397:
URL: https://github.com/apache/trafficcontrol/issues/6397#issuecomment-991464308
@ocket8888 can i take it?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@trafficcontrol.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [trafficcontrol] ocket8888 commented on issue #6397: login tokens should be single-use
Posted by GitBox <gi...@apache.org>.
ocket8888 commented on issue #6397:
URL: https://github.com/apache/trafficcontrol/issues/6397#issuecomment-987320044
> it's actually any change via PUT /user/current
That's correct.
> GET /user/login/token
That's a POST, not a GET; the request to Traffic Portal is a GET with the token in the query string but that results in a POST back to TO, but yeah, ideally you would only be able to use it to authenticate once, whereupon it's removed.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@trafficcontrol.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [trafficcontrol] mitchell852 commented on issue #6397: login tokens should be single-use
Posted by GitBox <gi...@apache.org>.
mitchell852 commented on issue #6397:
URL: https://github.com/apache/trafficcontrol/issues/6397#issuecomment-987289634
If my memory serves correctly, the token is deleted on user update (you said password reset but it's actually any change via PUT /user/current i think). it would make more sense imo to delete the token after it is used on GET /user/login/token so it's truly "single use".
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@trafficcontrol.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [trafficcontrol] asheikm commented on issue #6397: login tokens should be single-use
Posted by GitBox <gi...@apache.org>.
asheikm commented on issue #6397:
URL: https://github.com/apache/trafficcontrol/issues/6397#issuecomment-991464308
@ocket8888 can i take it?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@trafficcontrol.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org