Horizon dashboard leaks internal information through cookies

[Dave McCowan]

When horizon is configured where:
1) internalURL and publicURL are on different networks
2) horizon uses the internalURL endpoint for authentication

The cookie "login_region" will be set to the value configured as OPENSTACK_KEYSTONE_URL.

This URL contains the IP address of the internalURL of keystone.

In the case of a deployment where the internal network is different than the public network, the IP address of the internal network is considered sensitive information. By putting the OPENSTACK_KEYSTONE_URL in the cookie that is sent to the public network, horizon leaks the values of the internal network IP addresses.

[Matt Borland (palecrow)]

Yeah, it seems that we should research the value of this specific data being passed back to the client; in theory in a situation where there's an internalURL it shouldn't be exposed. It generally wouldn't provide any utility to the client that I can think of other than to glean internal information.

[Khanak Nangia (knangia)]

Could you provide more details. The thing can be organizations using OSS should not rely on the secrecy of their IP address of the internalURL of keystone.

[David Lyle (david-lyle)]

Exposing the internalURL is not a bug either way one views the internalURL, either it's a freely accessible endpoint to authorized users, or it's hidden behind a firewall. There is a related bug https://bugs.launchpad.net/horizon/+bug/1597864

[Luke Hinds (lhinds)]

Could some cores come out please to review the note:

https://bugs.launchpad.net/ossn/+bug/1585831

[Luke Hinds (lhinds)]

OSSN released: https://wiki.openstack.org/wiki/OSSN/OSSN-0073