nextcloud / nextcloud/documentation
Improve device wipe docs
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 628
- Forks
- 2.5k
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 135
Description
I have a question due to the a bit spartan documentation under https://docs.nextcloud.com/server/latest/developer_manual/client_apis/RemoteWipe/index.html:
Does Wiping also remove the API access of the device?
The attack vector is a stolen, unencrypted device. Once noticed, that the device was stolen, the user clicks on "Wipe Device".
Is it then possible for the attacker to read the token from the file system of the stolen device (possibly he doesn't boot the device nor start the nextcloud client) and retrieve user data from the server with it? Or is the token already "invalid" and no more API requests are possible (except for the wiping endpoints) once the device has been marked for wiping?
At least, that's what I would expect. If that is the case, maybe someone can update the documentation and add a sentence here?
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the Remote Wipe documentation at docs.nextcloud.com/server/latest/developer_manual/client_apis/RemoteWipe/index.html and confirm whether wiping invalidates the device's API token or leaves any requests usable. Update that page with a clear answer about token access after a wipe, once the behavior is confirmed.
Written by the indexing model from the issue text.
Assessment
- Domain
- documentation, security
- Issue type
- Documentation
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100