microsoft / microsoft/dev-tunnels

Tokens not deleted with tunnel

Open
#660 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
C#
Stars
508
Forks
52
Avg merge
20h 6m
Merged PRs (30d)
7

Description

As there is no way to delete/revoke access token it is suggested that deleting a tunnel deleted a token.
It is not true.

Reproduction:

  • Create tunnel
    devtunnel create mytunnel
  • Create a port
    devtunnel port create -p 5000
  • Create a token
    devtunnel token --scope connect
  • Host tunnel
    devtunnel host

curl with proper header works.

  • Delete tunnels
    devtunnel delete-all

  • Confirm no tunnels
    devtunnel list - empty list

  • Recreate a tunnel
    devtunnel create mytunnel

  • Create a port
    devtunnel port create -p 5000

  • DO NOT create a token

  • Host tunnel
    devtunnel host

The same curl request works.
If I create a new token for this tunnel, the same curl request as above, with the old token still works

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by running the listed devtunnel create, token, host, delete-all, and recreate sequence to confirm that the old token remains valid. Trace the tunnel deletion and token lifecycle from the CLI entry points, then add regression coverage showing that a token from a deleted tunnel is rejected after recreation.

Written by the indexing model from the issue text.

Assessment

Tech stack
csharp
Domain
authentication, cli, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
65/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.