rozhkovdmitrii
commented
1 year ago To provide the best security:
- Not use workarounds
- Make it able to authorize any client application, e.g. adex-cli, on mm2 only once and then use session JWT tokens with expiration time - one to access mm2, second one to update the first if the expiration is coming out.
- Strongly to not store password as it is in the mm2 configuration and prefer the Secure Password Authentication standards with hashes and salt are generated on the both sides server and client.
Impact
Currently rpc_password is stored in the adex-cli configuration as it is.
Todo:
It is suggested that the password be requested if it is not set as an environment variable for the current session. It would be great if it were stored in an encrypted form with an expiration time.