Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

🔒 : secure "/api/state" endpoint #59

Closed
juwit opened this issue Jul 21, 2019 · 0 comments · Fixed by #224
Closed

🔒 : secure "/api/state" endpoint #59

juwit opened this issue Jul 21, 2019 · 0 comments · Fixed by #224
Assignees
Labels
✨ feature:jobs Jobs 🔒 security Fixing security issues.
Milestone

Comments

@juwit
Copy link
Member

juwit commented Jul 21, 2019

Is your feature request related to a problem? Please describe.
/api/state endpoint may expose sensitive information.
This endpoint MUST be secured.
terraform httpd backend supports BASIC http authentication, so /api/state should support this kind of auth.
When the endpoint is secured, the backend configuration should be generated using credentials that allow a specific module to connect to its backend.

See https://www.terraform.io/docs/backends/types/http.html

Describe the solution you'd like
Maybe we should generate a "one-time" couple of credentials when generating a backend configuration for a stack. Or at least, a unique couple of credentials for each stack, so that a stack owner cannot see other stacks information.
We may need to implement a custom spring UserDetailsService for this purpose.

Describe alternatives you've considered
N/A

Additional context
N/A

@juwit juwit added the ✨ enhancement New feature or request label Jul 21, 2019
@juwit juwit self-assigned this Feb 4, 2020
@juwit juwit added this to the 1.3.0 milestone Feb 4, 2020
@juwit juwit added 🔒 security Fixing security issues. ✨ feature:jobs Jobs and removed ✨ enhancement New feature or request labels Feb 5, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
✨ feature:jobs Jobs 🔒 security Fixing security issues.
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant