search

datahub-project / datahub

The Metadata Platform for your Data and AI Stack
https://datahubproject.io
Apache License 2.0
9.94k stars 2.94k forks source link

Username or email are stored in html5 persistent storage #10929

Open udays-visa opened 4 months ago

udays-visa commented 4 months ago

Describe the bug Username and/or email are stored in persistent html5 storage using localStorage construct. Localstorage items do not get destroyed when session ends or browser window gets closed. This persistent data can be used by other malicious users to potentially gain access to datahub instance. Moving data from localStorage to sessionStorage will address potential PI data violation and avoid malicious access.

To Reproduce Steps to reproduce the behavior:

  1. Login with any user account
  2. Open browser console and switch to application tab or where we can observe browser storage
  3. Select localStorage
  4. Check the value for field "__user_id"

Expected behavior Usernames or emails should not be stored in unencrypted persistent storage. Moving this data to sessionStorage which is temporary in nature will resolve potential issues.

Screenshots image

Desktop (please complete the following information):

433B commented 1 month ago

Hello! I'm interested in this topic, could I have it for myself? I have experience in this area. Additionally, this is a key assignment for one of my university courses.

DanielVsh commented 1 month ago

Hi @udays-visa, can i contribute there ?

udays-visa commented 1 month ago

yes please go ahead and raise a PR.