- Notifications
You must be signed in to change notification settings - Fork1k
feat(cli): store session token in OS keyring with file fallback#20256
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.
Already on GitHub?Sign in to your account
base:main
Are you sure you want to change the base?
Uh oh!
There was an error while loading.Please reload this page.
Conversation
This change implements secure storage of the CLI token using the operating system keyringwith a fallback to the previous plaintext file storage. Previously, the Coder CLI storedauthentication tokens in plaintext configuration files, which posed a security riskbecause users' tokens are stored unencrypted and can be easily accessed by otherprocesses or users with file system access.The secure storage is platform dependent. The security command is used on macOS.Windows Credential Manager API is used on Windows. Linux depends on GNOME keyring andSecret Service API (via D-Bus).
| returnxerrors.Errorf("write session token: %w",werr) | ||
| } | ||
| ifr.tokenBackend.PreferredLocation()==sessionstore.LocationKeyring&&location==sessionstore.LocationFile { | ||
| cliui.Warn(inv.Stderr,"⚠️ Token stored in PLAIN TEXT because keyring access failed.") |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
These messages should probably provide a docs link. I see some GitHub CLI users flagging thishttps://redirect.github.com/cli/cli/issues/8954
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
Uh oh!
There was an error while loading.Please reload this page.
This change implements secure storage of the CLI token using the operating system keyring with a fallback to the previous plaintext file storage. Previously, the Coder CLI stored authentication tokens in plaintext configuration files, which posed a security risk because users' tokens are stored unencrypted and can be easily accessed by other processes or users with file system access.
The secure storage is platform dependent. The security command is used on macOS. Windows Credential Manager API is used on Windows. Linux depends on GNOME keyring and Secret Service API (via D-Bus).
We're using the go-keyring package because it's prior art from the GitHub CLI.
Known TODOs:
#19403