Secret used for authentication and authorization is placed in configuration files openly
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 431
- Forks
- 179
- Avg merge
- 2d 9h
- Merged PRs (30d)
- 71
Description
Is your feature request related to a problem? Please describe.
It's insecure to keep secrets used for authentication and authorization in configuration files openly.
It's stored in k8s under environment variable TEMPORAL_AUTH_CLIENT_SECRET
Describe the solution you'd like
Add separate AuthProvider.ClientSecretFile under https://github.com/temporalio/ui/blob/main/server/server/config/config.go to read secret from file
Describe alternatives you've considered
No alternative.
Additional context
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in server/server/config/config.go and inspect the AuthProvider configuration alongside the TEMPORAL_AUTH_CLIENT_SECRET environment setting. Trace where the client secret is consumed, then implement the requested AuthProvider.ClientSecretFile behavior so authentication and authorization can obtain the secret from a file.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, kubernetes
- Domain
- authentication, authorization, backend, security
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 45/100