Kitware / wslink

Python/JavaScript library for communicating over WebSocket
https://kitware.github.io/wslink/
BSD 3-Clause "New" or "Revised" License
83 stars 26 forks source link

feat(security): Added authKeyFile argument #124

Closed jwindgassen closed 1 year ago

jwindgassen commented 1 year ago

On most multi-user setups, command line arguments can be viewed by anyone on that system. Passing the authKey via a command line argument can be a security flaw.

Allowing the user to pass the path to a file instead will eliminate that problem. Using a tempfile that can only be read by the user, we can safely pass the authKey without the possibility of a third party reading it.

I added the authKeyFile option, that allows for exactly that.

jourdain commented 1 year ago

This does not need to be in wslink. This can be managed within trame-server directly.