Re: [I] Prohibiting Default Username and Password Logins. [incubator-seata]

["YongGoose (via GitHub)" <gi...@apache.org>]

YongGoose commented on issue #6396:
URL: https://github.com/apache/incubator-seata/issues/6396#issuecomment-2829261903

   > Right now, the Seata console uses a username and password for login, with the default being seata/seata. A lot of users don’t change these default credentials in the config files when setting things up, and then deploy it to public-facing environments. This leaves the door wide open for unauthorized folks to log in with the default info and snoop around.
   > 
   > Here’s the fix we’re thinking: Add an interactive script or setup wizard during installation that forces users to either input or auto-generate their own username, password, and secret key on first launch. That way, there’s no default sensitive info hanging around, and the system stays way more secure.
   
   I've made the changes — could you please review the PR to see if it aligns with your suggestions?
   - https://github.com/apache/incubator-seata/pull/7261
   
   Additionally, there was a issue suggesting that `passwords` should be encrypted. 
   - https://github.com/apache/incubator-seata/issues/7307
   
   I checked the code and confirmed that the `WebSecurityConfig` class in the `console` module already includes a `PasswordEncoder`. With this in place, passwords entered by users can be encrypted and later verified using the `passwordEncoder`. 
   
   If it looks reasonable, i’m planning to implement this logic in a separate PR.
   WDYT?
   
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For additional commands, e-mail: notifications-help@seata.apache.org