S3 connection credentials stored in localStorage

Open
#306 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
5/5
Estimated time
Over a week
Newbie friendliness
35/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Active
Tech stack
typescript

Research direction

Start with src/lib/storage/connection-storage.ts and src/lib/components/storage/StorageConnectForm.svelte to trace how S3 access key IDs and secret keys enter and persist in localStorage. Review the authentication and server-session boundaries before proposing a design. Done means credentials are no longer stored in plaintext client storage and reconnect behavior follows the agreed authenticated-session approach.

Written by the indexing model from the issue text.

Description

File: src/lib/storage/connection-storage.ts, src/lib/components/storage/StorageConnectForm.svelte

S3 connection credentials (access key ID and secret access key) are persisted in plaintext localStorage so the browser can auto-reconnect after a page reload or server restart. localStorage is accessible to any JavaScript running on the page and is visible in browser DevTools, making it vulnerable to XSS. Acceptable for the current early stage where the alternative is users having to re-enter credentials after every server restart. Long-term fix: persist encrypted credentials server-side, tied to the authenticated session; send only a session token to the client.

Dominant language
TypeScript
Stars
1
Forks
0
Avg merge
22h 6m
Merged PRs (30d)
12

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from stackabletech/cockpit

All issues in stackabletech/cockpit

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.