Token in URL is a security risk
Bug #861854 reported by
Ziad Sawalha
This bug affects 1 person
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
OpenStack Identity (keystone) |
Fix Released
|
High
|
Dolph Mathews |
Bug Description
Raised by anotherjesse. The GET /tokens/id use case requires the token in the URL. The token by itself provides access to resources, so having that go to an HTTP log is a security risk, especially for tokens with a long life.
Changed in keystone: | |
importance: | Undecided → Critical |
Changed in keystone: | |
status: | New → Confirmed |
Changed in keystone: | |
milestone: | essex-2 → essex-3 |
Changed in keystone: | |
assignee: | nobody → Rackspace Integration (rackspace-integration) |
Changed in keystone: | |
status: | Confirmed → In Progress |
Changed in keystone: | |
status: | In Progress → Fix Committed |
Changed in keystone: | |
assignee: | Ziad Sawalha (ziad-sawalha) → nobody |
importance: | Critical → High |
tags: | added: security |
security vulnerability: | yes → no |
tags: | added: v3api |
Changed in keystone: | |
assignee: | nobody → Dolph Mathews (dolph) |
Changed in keystone: | |
milestone: | none → grizzly-3 |
status: | Fix Committed → Fix Released |
Changed in keystone: | |
milestone: | grizzly-3 → 2013.1 |
To post a comment you must log in.
How should we fix this? Should we hash the token so it goes encrypted over the wire? Should we re-design the validate-token? Would having the token as an http header in the call help?