Bearer token authentication for the frontend API

Open
#22 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
5/5
Estimated time
Over a week
Newbie friendliness
30/100
Issue type
Feature
Clarity
Needs clarification
Activity status
Active
Tech stack
javascript
Domain
api, authentication, security

Research direction

Start by tracing the existing Basic authentication path for API access and its LDAP credential handling. Define the Bearer-token flow around MFA, token scopes and lifetimes, and audit logging; done should mean API users can authenticate with MFA and use appropriately limited tokens instead of Basic credentials.

Written by the indexing model from the issue text.

Description

enhancement

We currently support Basic authentication via LDAP credentials for API access.

We want to move to Bearer authentication instead, where users can authenticate with MFA and get a token to use in automations. This has many advantages:

  • the blast radius of a lost ASF password is reduced (the password doesn't give access to the API without MFA)
  • the risk of a lost ASF password is reduced (if the dash API is ever compromised, it would no longer allow the attacker to steal ASF passwords)
  • the impact of a compromise of a tool that uses this API is reduced (since it can no longer expose an ASF password, and tokens can have limited scopes and lifetimes)
  • we can have better audit logging of different types of authentication
Dominant language
JavaScript
Stars
0
Forks
6
Avg merge
1d 7h
Merged PRs (30d)
8

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from apache/security-dash

All issues in apache/security-dash

Similar issues

More JavaScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.