-
Notifications
You must be signed in to change notification settings - Fork 0
Description
In addition, I also noticed that the credentials are stored under a single secret on Google Cloud, and I presume this will also be the case in a local environment. Since the credentials are stored in a way where the Zowe config path is the "key" for the object, @zFernand0 and I quickly discussed a scenario where he could potentially replace my credentials in the secret object:
- Create a path that matches the file path my credentials are stored under
- Set the
ZOWE_CLI_HOMEenvironment variable to fall under this path (e.g. if my config is/a/b/c/zowe.config.json,ZOWE_CLI_HOMEwould be/a/b/c). - Right click on a session in Zowe Explorer -> "Update Credentials"
- After entering in the username and password, my stored credentials will be overwritten in the secret object w/ the new credentials provided.
Could we potentially avoid this by generating a unique hash on the user's end, and then chaining that with the file path to make a unique key? Or, could we generate a unique hash and simply use that as the key?
With either proposal, we would have to store the hash/identifier somewhere (such as in the Zowe config itself), but this would prevent someone from intentionally overwriting other user's credentials in the same cluster.
Originally posted by @traeok in zowe/zowe-explorer-vscode#2230 (review)
Metadata
Metadata
Assignees
Labels
Type
Projects
Status