mirror of
https://github.com/retspen/webvirtcloud.git
synced 2026-04-25 07:25:53 +03:00
[GH-ISSUE #374] Feature request: dynamic tokens for webvnc console link #235
Labels
No labels
bug
enhancement
pull-request
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
starred/webvirtcloud#235
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @lord-kyron on GitHub (Oct 15, 2020).
Original GitHub issue: https://github.com/retspen/webvirtcloud/issues/374
@Real-Gecko @catborise - can you guys make the tokens on the webvnc console link (the token in the browser link) to STOP to be static (per vm) and to be generated automatically dinamic every time a new webvnc console is requested. This way it will prevent a person knowing the exact link (including the token) and open directly the vnc console. If it is dynamic - once you request a webvnc window (from the connect button) a new link and token are generated and once you close the window (the vnc connection) the old token have to expire. What do you think?
@lord-kyron commented on GitHub (Nov 12, 2020):
@catborise - will this be something possible to implement?
@catborise commented on GitHub (Nov 20, 2020):
uuid is primary key for instances. it could not change.
if someone has an user credentials he should access any instance.
but there is a glitch i think. someone is not an admin but only a user and it has a uuid info and host info. it could access someone's instance console... i think it is a security issue. we should control if user has ownership or not...
nice catch... my view is that it is a security issue...
we should provide a security to prevent that situation.
@lord-kyron commented on GitHub (Nov 20, 2020):
Yes, that was what I meant when i opened this request. I already had traces in the past of someone trying to login on console of one of my VMs.
@catborise commented on GitHub (Nov 20, 2020):
It is fixed . If someone is not owner of instance and not a superuser, cannot access Console even if he has uuid and host number