Store auth token in OS keychain
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 1.9k
- Forks
- 474
- Avg merge
- 23h 30m
- Merged PRs (30d)
- 53
Description
Which problem is this feature request solving?
AFAICT netlify-cli stores the auth token on disk in ~/Library/Preferences/netlify/config.json on macOS.
Storing any secrets in plaintext on disk isn't great from a security perspective as an attacker with local system access can gain access to these secrets.
Describe the solution you'd like
It would be better to store the auth token in the operating system keychain (for macOS, Keychain) which even when unlocked, requires the user to enter their password to view the token. This is how, for example, VS Code stores the user's auth token to GitHub.
Pull request (optional)
- I can submit a pull request.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing where netlify-cli reads and writes the auth token, including the macOS path ~/Library/Preferences/netlify/config.json. Then determine the supported operating-system keychain approach and its effect on existing authentication. Done means the token is protected by the OS keychain while login and authenticated CLI commands continue to work.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- cli, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100