-no-print flag does not work if login successfully but failed to storing token
- Dominant language
- Go
- Stars
- 36.3k
- Forks
- 4.8k
- PR merge metrics
- PR metrics pending
Description
**Describe the bug**
-no-print flag does not work if login successfully but failed to store the token.
We are using a custom Docker image with the Vault CLI installed,
running in a Google Cloud Build pipeline.
we accidentally removed the write permission of home directory,
so that vault login succeed but failed to store the key to the disk.
and then the token leaked to the stdout so that the log was store in the Cloud Logging.
```
Step #1: Key Value
Step #1: --- -----
Step #1: token *sensitive data*
Step #1: token_accessor *sensitive data*
Step #1: token_duration 30m
Step #1: token_renewable true
Step #1: token_policies *sensitive data*
Step #1: identity_policies []
Step #1: policies *sensitive data*
Step #1: token_meta_project_id *sensitive data*
Step #1: token_meta_role *sensitive data*
Step #1: token_meta_service_account_email *sensitive data*
Step #1: token_meta_service_account_id *sensitive data*
Step #1: Error storing token: open /builder/home/.vault-token.tmp: permission denied
Step #1: Authentication was successful, but the token was not persisted. The resulting
Step #1: token is shown below for your records.
Step #1:
```
**To Reproduce**
Steps to reproduce the behavior:
1. remove the write permission of home directory
2. login the vault with -no-print
**Expected behavior**
the cli should not print the token to stdout if -no-print flag is there,
since it might cause a security issue.
**Environment:**
* Vault Server Version (retrieve with `vault status`): not sure (managed by other team)
* Vault CLI Version (retrieve with `vault version`): v2.0.3
* Server Operating System/Architecture: Alpine Linux v3.24
Vault server configuration file(s):
```hcl
# The vault server is not hosted by me, so I do not have access to the config.
```
**Additional context**
Contributor guide
Research direction
Start by locating the Vault CLI login handling and the -no-print flag implementation, then reproduce the failure with an unwritable home directory. Confirm that login still reports the storage error without printing the token to stdout when -no-print is supplied.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- authentication, cli, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 55/100