stackabletech / stackabletech/cockpit
S3 connection credentials stored in localStorage
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 1
- Forks
- 0
- Avg merge
- 22h 6m
- Merged PRs (30d)
- 12
Description
File: src/lib/storage/connection-storage.ts, src/lib/components/storage/StorageConnectForm.svelte
S3 connection credentials (access key ID and secret access key) are persisted in plaintext localStorage so the browser can auto-reconnect after a page reload or server restart. localStorage is accessible to any JavaScript running on the page and is visible in browser DevTools, making it vulnerable to XSS. Acceptable for the current early stage where the alternative is users having to re-enter credentials after every server restart. Long-term fix: persist encrypted credentials server-side, tied to the authenticated session; send only a session token to the client.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with src/lib/storage/connection-storage.ts and src/lib/components/storage/StorageConnectForm.svelte to trace how S3 access key IDs and secret keys enter and persist in localStorage. Review the authentication and server-session boundaries before proposing a design. Done means credentials are no longer stored in plaintext client storage and reconnect behavior follows the agreed authenticated-session approach.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- authentication, frontend, security
- Issue type
- Bug
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100