search

me-box / core-export-service

export service for databox platform
MIT License
3 stars 4 forks source link

fix token secret en-/de-coding #26

Closed sevenEng closed 7 years ago

sevenEng commented 7 years ago

for #25

I found two points that are problematic:

  1. I could get the same arbiter token as this by base64 encoding the file content. Just wondering if this is the intended behaviour, as I could see in CM that the token is encoded before writing to the file, maybe what we want here is base64 decoding? If not, just ignore this, I'll keep the encoding part in this PR. For what it worth, the node js module doc seems not accurate enough about fs.readFileSync's behaviour with regards to encoding argument(to encode or to decode?), but in the source code, buffer.toString(encoding) is called before returning, so I guess the argument is used to indicate encoding scheme.

  2. As pointed out by @yousefamar, the returned secret should be used directly in macaroon verification, so removed the decoding step.

haddadi commented 7 years ago

Haven't merged yet so @yousefamar and @Toshbrown can check. Hope moving on from node will help here too