Notifications should not include auth token

[Sandy Walsh]

The auth token is part of the context and is being included in all Event Notifications. Exposing the auth token is a potential security risk. It should be stripped out before sending the event.

[Thierry Carrez (ttx)]

Just for my information (and please excuse my ignoranceà, who actually gets notified in events ?
Trying to see if that could be exploited the way it is, or if it's just a welcome security stregthening improvement.

[Sandy Walsh (sandy-walsh)]

Notifications are off by default, so there's no exposure. Usually it's only turned on for billing purposes and that would be internal use only. So I would classify it as low risk.

[Davanum Srinivas (DIMS) (dims-v)]

Newbie questions - How does one switch it on? where exactly does the auth token show up? (logs?)

[Sandy Walsh (sandy-walsh)]

@dims-v it shows up in the JSON payload of the event. You can enable it if you follow the "Configuring Nova to generate Notification" steps outlined in the README here: https://github.com/rackspace/stacktach

[Thierry Carrez (ttx)]

Converted to "welcome security stregthening improvement" status

[Russell Bryant (russellb)]

This is really an issue with the rpc code in oslo-incubator, so I'm going to move this bug.

[Andrew Bogott (andrewbogott)]

Pretty sure this is just backing up what Russell just said, but just to make sure:

It is useful for the auth token to be passed /to/ the notification code, because certain notifiers (specifically custom ones that use the plugin framework) may make appropriate use of it. The notification drivers themselves should strip out the auth before writing the notification to a log or putting it on the wire or whatever.

[Thierry Carrez (ttx)]

Looks like we are unsure this should be solved.

[Launchpad Janitor (janitor)]

[Expired for oslo.messaging because there has been no activity for 60 days.]