cryostatio / cryostat-web

Web front-end for Cryostat: Secure JDK Flight Recorder management for containerized JVMs
https://cryostat.io/
Other
10 stars 20 forks source link

fix(jmxauth): remove references to client-side localstorage JMX credential passthrough #1241

Closed andrewazores closed 4 months ago

andrewazores commented 4 months ago

Welcome to Cryostat! 👋

Before contributing, make sure you have:

To recreate commits with GPG signature git fetch upstream && git rebase --force --gpg-sign upstream/main


Fixes #1239

Description of the change:

The X-JMX-Authentication and X-JMX-Authorization headers were historically used by older Cryostat versions so that clients could supply these headers with API requests, and Cryostat would use them to set the JMX connection credentials when connection to target applications. Cryostat 3.0 does not implement this behaviour, so here references to it and the mechanism for selecting it are removed from the UI. It is no longer supported because it has been replaced by the server-side encrypted database/encrypted table for JMX credentials, which are more powerful due to the matchExpression mechanism, as well as more secure since they are encrypted at rest in the database rather than held in browser localStorage in plaintext.

How to manually test:

  1. Run CRYOSTAT_IMAGE=quay.io... sh smoketest.sh...
  2. ...