Open Barbiero opened 2 years ago
I personally favor the environment variable approach, but there is utility in CLI flags/arguments too.
I really like the idea of environment variables. I'd like to not include the actual sensitive strings in the command line, since those could be viewed and potentially stolen by an attacker.
In the meantime, to mitigate this issue for me, I did a pull request #1432 for BitWarden scripts to automate this process like the 1Password automation does. Maybe it can be a stopgap fix for most folks, until something is added directly into the launcher itself.
Update disclaimer
What happened, what did not, what did you want to happen?
I've been experimenting with the Bitwarden CLI and I noticed I can get the TOTP(as well as user and password) programatically with an API key. In fact. I managed to write a pwsh script that hooks into the XIVLauncher OTPListener server.
I would be nice if we could execute XIVLauncher from the command line with flags like:
notice that I mention a "passwordfile" flag rather than the password itself as I believe it would be more secure to store it in a read-only user-limited file rather than passing it through the cmd line directly.
An alternative would be to use specific environment variables(like XL_USERNAME and XL_PASSWORD) with a
--totp
flag.These are all so that we don't actually need to use the otplistener server if we can automate our login flow with a CLI tool(like the bitwarden CLI above, but I bet there are other tools around).
Version
Both
Platform
Applies to all