Password Protect OAuth Token Related Methods #2378
Replies: 10 comments
-
|
Thank you for filing this feature request. We appreciate your feedback and will review the feature at our next grooming or sprint planning session. We prioritize feature requests with more upvotes and comments. |
Beta Was this translation helpful? Give feedback.
-
|
This issue has been linked to a new work item: W-10023371 |
Beta Was this translation helpful? Give feedback.
-
|
Where does the password come from? We don't put secrets in flags (they'll end up in shell history!), so there are commands that prompt a user to enter a credential. We typically store those, encrypted locally. Without locally storing it, users would have to enter the password on every command that interacts with any org (which would block scripting use cases). Do you have some examples of some commands that you'd want to have a password option, and drafts of their usage? |
Beta Was this translation helpful? Give feedback.
-
|
@mshanemc, you are correct that each method would need the password parameter, but the parameter can be set via environment variable and/or passed from the parent Application, like VS Code. From a shell sfdx auth:list --json --password Mypassw1234From a script: ## set the password parameter
$password = "Mypassw1234"
# retrieve the password for use
sfdx auth:list --json --password + &password
sfdx force:apex:execute -u [email protected] -f ~/test.apex --password + &password VS Code Extensions support using environment variables like this:
# retrieve the password from the environment variable
sfdx auth:list --json --password + process.env.SFDX_PWD |
Beta Was this translation helpful? Give feedback.
-
|
@mshanemc You could also use this idea to allow us to have access to the refresh token. If the developer pass the password parameter, or an ENV variable called SFDX_PWD is available, then print the refreshToken in the output of sfdx auth:list --json. |
Beta Was this translation helpful? Give feedback.
-
|
I just thought about it again. It will never be secure. If a hacker access your computer he is able to retrieve any ENV variables you have there. He would still be able to get access to your orgs through sfdx. That was the reason I also closed that feature that request access to the refresh token. |
Beta Was this translation helpful? Give feedback.
-
|
@allan we need to figure out credentials management. Sharing OAuth tokens is a fail for the IAM Designer exam. This vulnerability affects AWS and Azure CLI too. The CLI is gonna get banned once CISO leadership realizes the vulnerabilities it introduces. Some options are:
|
Beta Was this translation helpful? Give feedback.
-
|
related oclif/oclif#1157 |
Beta Was this translation helpful? Give feedback.
-
|
there should not be secrets (ex: passwords) in flags. That's too easy to end up in shell history, and is inviting people to use them in scripts. prompting the user for some sort of password interactively would be possible. It would make commands unscriptable. |
Beta Was this translation helpful? Give feedback.
-
Can we get a
passwordparameter added to all of the http related call that use OAuth related tokens?The
key.jsonand/or local keychain concept it too easy to exploit.Adding a
passwordparameter to the various CLI methods would allow for the use of local encryption without exposing an org to a hacked Admin/Dev machine.Yes, it would be possible to grab the password via a key logger, but simple password protection would be a significant security improvement over the current CLI.
Beta Was this translation helpful? Give feedback.
All reactions