microcks / microcks/microcks-cli
Security: Use OS keychain or encryption for storing credentials in config file instead of plain text
- Dominant language
- Go
- Stars
- 52
- Forks
- 68
- Avg merge
- 6h 54m
- Merged PRs (30d)
- 10
Description
### Describe the bug
Following up on a comment from https://github.com/microcks/microcks-cli/issues/503#issuecomment-5312648283 by @Harsh4902, the CLI currently stores credentials in the local configuration file in plain text.
Specifically, looking at `pkg/config/localconfig.go`, the `LocalConfig` struct stores `AuthToken` and `RefreshToken` inside the `User` struct, and `ClientSecret` inside the `Auth` struct. These are serialized directly to a YAML file (typically `~/.config/microcks/config`).
If the file permissions on the config file are not strictly locked down, or if a malicious script gets read access to the user's home directory, these credentials can be easily stolen.
### Expected behavior
CLI tools typically avoid storing access tokens, refresh tokens, and client secrets in plain text. Instead, we should consider:
1. Using the operating system's native secure keystore/keychain (e.g., macOS Keychain, Windows Credential Manager, Linux Secret Service) using a library like [zalando/go-keyring](https://github.com/zalando/go-keyring) or [99designs/keyring](https://github.com/99designs/keyring).
2. As a fallback, strictly enforcing `0600` permissions on the config file so that only the file owner can read it (though native keystore is much preferred).
### Actual behavior
_No response_
### How to Reproduce?
_No response_
### Microcks version or git rev
_No response_
### Install method (`docker-compose`, `helm chart`, `operator`, `docker-desktop extension`,...)
_No response_
### Additional information
### Proposed Solution
1. Integrate a keychain library like `github.com/zalando/go-keyring`.
2. When saving a configuration (in `pkg/config/localconfig.go`), extract `AuthToken`, `RefreshToken`, and `ClientSecret` from the struct.
3. Save these extracted secrets securely into the OS keychain, using the server name or user context as the service key.
4. Replace the struct values with a placeholder (e.g., `keychain-stored`) before writing the remaining configuration to the YAML file.
5. When reading the configuration, dynamically fetch the secrets from the keychain back into the struct.
### Impact
Storing credentials securely will prevent local token theft and align `microcks-cli` with industry best practices for CLI security.
Contributor guide
Research direction
Start in pkg/config/localconfig.go by tracing how AuthToken, RefreshToken, and ClientSecret are serialized to and loaded from the YAML configuration. Evaluate the proposed OS keychain integration and 0600 fallback, then verify that secrets are not stored in plain text and remain available in the loaded configuration.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- authentication, cli, security
- Issue type
- Bug
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100