API key can be created for a nonexistent user
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 6.5k
- Forks
- 787
- PR merge metrics
- No merged PRs in 30d
Description
An API key can be created for a user that doesn't exists (i.e. st2 apikey create -u foobar where foobar is a nonexistent user). The API key created for this nonexistent user foobar can be used to execute an action and the execution is listed under foobar in context.user. The API key should not have been created in the first place if the user does not exist. Also, since API key doesn't have expiration, there should be another validation during runtime to make sure the user still exists before the API key is verified for other StackStorm operations.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the code paths behind st2 apikey create -u foobar and the runtime API-key verification used before StackStorm operations. Done means creation rejects nonexistent users and runtime verification also rejects keys whose users no longer exist; add or update tests for both cases.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- api, authentication, authorization, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100