Closed mKowalski256 closed 1 month ago
Fixed with commit 73ae18d522a - System Admin should no longer be able to retrieve API key generated by the user.
Note that System Admin can still revoke/regenerate new API key for the user - these are useful in some support scenarios, and risk-wise it's similar to how we allow System Admin to change user's password.
To Reproduce Steps to reproduce the behavior:
Additionally, there is a sysadmin API allowing to retrieve users' API keys.
Expected behavior Only user should be able to access their API key. While the System Admin is a privileged user, they shouldn't be able to impersonate users outside the impersonations scheme provided by the GUI app itself.
There may be specific migration scenarios that use API to re-create user's content, and for that they need to create/retrieve/delete API keys. We may keep supporting API methods meant for that, but these should be guarded by deployment property that is disabled by default.
Also note that while action of viewing user's API key is traceable (logged in
httpRequests.log
anderror.log
) it's maybe worth additional logging in SecurityEvents.txt.Additional context Based on a reported issue https://github.com/rspace-os/rspace-web/issues/58.