search

sintaxi / surge

CLI for the surge.sh CDN
https://surge.sh
2.84k stars 135 forks source link

Revoke token #491

Open wd15 opened 1 year ago

wd15 commented 1 year ago

Can an existing token be revoked with the Surge CLI? surge token --help doesn't give any indications of possible sub-commands.

danielfdsilva commented 1 year ago

In light of Circle CI's security incident this would be really needed.

brint commented 1 year ago

I was digging through the code and found this:

https://github.com/sintaxi/surge/blob/32eaaa2c5731c20093c12fde4c92d58bacda377a/lib/middleware/util/helpers.js#L234

By doing a password reset on my account, I was able to get a new token after the password reset.

danielfdsilva commented 1 year ago

@brint Unfortunately this does not revoke the old token. Here's how I tested it:

Got a token with surge token, logged out and reset the password. Tried the previously issued token by doing surge list --token <token> and it was still working.

alexgleason commented 11 months ago

Bump

mauricioklein commented 10 months ago

I confirm that /token/reset doesn't reset the token.

curl -vvv -XPOST https://surge.surge.sh/token/reset/[my email here]

Got a 201 back (with no authentication whatsoever 🤯), but token remains the same.

If at least we got access to their API documentation, we would have a workaround until the CLI is fixed