OpenStack Identity (keystone)

  1. Bug #1779205
  2. Comment #35

Comment 35 for bug 1779205

Revision history for this message
Lance Bragstad (lbragstad) wrote : Re: GET /v3/OS-FEDERATION/projects leaks project information

I would adjust the description in comment #30 by removing the term "federated":

"By doing GET /v3/OS-FEDERATION/projects with a federated token
an actor may discover projects they have no authority to access,
leaking all projects in the deployment and their attributes."

to

"Calling GET /v3/OS-FEDERATION/projects an actor may discover
projects they have no authority to access, leaking all projects
in the deployment and their attributes."