exercism / exercism/cli

Make CLI configuration token secure

Open
#961 3 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
1.4k
Forks
363
Avg merge
6d 13h
Merged PRs (30d)
2

Description

## Description
Configuring the CLI requires users to specify the token with the `--token` flag.
This causes the token to stick around in the command line history, which can be easily viewed by someone.
(e.g. just `$ history | grep "exercism configure --token"` can bring my token right in front of the attacker)

## Solution
It would be safer if the equivalent of Python's getpass library is implemented to obtain input (or just plain STDIN). That way, the token is taken as input from a prompt and is not stored in the commands history.

## Additional Notes
Not that it's a huge security risk for users with personal computers, but it would be helpful for shared machines.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.