microcks / microcks/microcks-cli

Security: Use OS keychain or encryption for storing credentials in config file instead of plain text

Open
#507 2 comments 0 reactions 0 assignees View on GitHub
component/cli keep-open
Dominant language
Go
Stars
52
Forks
68
Avg merge
6h 54m
Merged PRs (30d)
10

Description

### Describe the bug

Following up on a comment from https://github.com/microcks/microcks-cli/issues/503#issuecomment-5312648283 by @Harsh4902, the CLI currently stores credentials in the local configuration file in plain text.

Specifically, looking at `pkg/config/localconfig.go`, the `LocalConfig` struct stores `AuthToken` and `RefreshToken` inside the `User` struct, and `ClientSecret` inside the `Auth` struct. These are serialized directly to a YAML file (typically `~/.config/microcks/config`).

If the file permissions on the config file are not strictly locked down, or if a malicious script gets read access to the user's home directory, these credentials can be easily stolen.

### Expected behavior

CLI tools typically avoid storing access tokens, refresh tokens, and client secrets in plain text. Instead, we should consider:
1. Using the operating system's native secure keystore/keychain (e.g., macOS Keychain, Windows Credential Manager, Linux Secret Service) using a library like [zalando/go-keyring](https://github.com/zalando/go-keyring) or [99designs/keyring](https://github.com/99designs/keyring).
2. As a fallback, strictly enforcing `0600` permissions on the config file so that only the file owner can read it (though native keystore is much preferred).

### Actual behavior

_No response_

### How to Reproduce?

_No response_

### Microcks version or git rev

_No response_

### Install method (`docker-compose`, `helm chart`, `operator`, `docker-desktop extension`,...)

_No response_

### Additional information

### Proposed Solution
1. Integrate a keychain library like `github.com/zalando/go-keyring`.
2. When saving a configuration (in `pkg/config/localconfig.go`), extract `AuthToken`, `RefreshToken`, and `ClientSecret` from the struct.
3. Save these extracted secrets securely into the OS keychain, using the server name or user context as the service key.
4. Replace the struct values with a placeholder (e.g., `keychain-stored`) before writing the remaining configuration to the YAML file.
5. When reading the configuration, dynamically fetch the secrets from the keychain back into the struct.

### Impact
Storing credentials securely will prevent local token theft and align `microcks-cli` with industry best practices for CLI security.

Contributor guide

Open the contributing guide

Research direction

Start in pkg/config/localconfig.go by tracing how AuthToken, RefreshToken, and ClientSecret are serialized to and loaded from the YAML configuration. Evaluate the proposed OS keychain integration and 0600 fallback, then verify that secrets are not stored in plain text and remain available in the loaded configuration.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
authentication, cli, security
Issue type
Bug
Difficulty
5/5
Estimated time
Over a week
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.