Restrict permissions on disk token cache

NEWS.md

@@ -1,5 +1,7 @@
 # httr2 (development version)
 
+* The on-disk OAuth token cache (used by `req_oauth_*(cache_disk = TRUE)`) now creates its directories with mode `700` and token files with mode `600` so that cached tokens are not readable by other users on the same machine.
+
 # httr2 1.3.0
 
 * Fixed OAuth token cache pruning so that it actually matches the encrypted `.rds.enc` files written to disk; previously the pruning pattern only matched an unencrypted `.rds` file that was never created, so cached tokens were never automatically deleted regardless of age.

R/oauth.R

@@ -194,7 +194,9 @@ cache_mem <- function(client, key = NULL) {
 }
 cache_disk <- function(client, key = NULL) {
   app_path <- file.path(oauth_cache_path(), client$name)
-  dir.create(app_path, showWarnings = FALSE, recursive = TRUE)
+  dir.create(app_path, showWarnings = FALSE, recursive = TRUE, mode = "0700")
+  # Fix up directories created by previous versions of httr2
+  Sys.chmod(app_path, "0700")
 
   path <- file.path(app_path, paste0(hash(key), "-token.rds.enc"))
   list(
@@ -204,6 +206,7 @@ cache_disk <- function(client, key = NULL) {
     set = function(token) {
       cli::cli_inform("Caching httr2 token in {.path {path}}.")
       secret_write_rds(token, path, obfuscate_key())
+      Sys.chmod(path, "0600")
     },
     clear = function() if (file.exists(path)) file.remove(path)
   )

tests/testthat/test-oauth.R

@@ -195,6 +195,29 @@ test_that("can store on disk", {
   expect_equal(cache$get(), NULL)
 })
 
+test_that("disk cache is only accessible to current user", {
+  client <- oauth_client(
+    id = "x",
+    token_url = "http://example.com",
+    name = "httr2-test"
+  )
+  cache <- cache_disk(client, NULL)
+  withr::defer(cache$clear())
+  suppressMessages(cache$set(1))
+  expect_equal(cache$get(), 1)
+
+  # On Windows Sys.chmod() only affects the read-only attribute
+  skip_on_os("windows")
+  app_path <- file.path(oauth_cache_path(), client$name)
+  token_path <- dir(
+    app_path,
+    pattern = "-token\\.rds\\.enc$",
+    full.names = TRUE
+  )
+  expect_equal(file.mode(app_path), as.octmode("700"))
+  expect_equal(file.mode(token_path), as.octmode("600"))
+})
+
 test_that("can explicitly clear cached value", {
   client <- oauth_client(
     id = "x",