security: exposed token in user.py

yuvipanda / hubtraf

Traffic simulator for JupyterHub

BSD 3-Clause "New" or "Revised" License

40 stars 24 forks source link

security: exposed token in user.py #26

Closed consideRatio closed 4 years ago

consideRatio commented 4 years ago

https://github.com/yuvipanda/hubtraf/blob/78ab8b5ad9d09ce245f5056adebce843978c4351/hubtraf/user.py#L96-L98

Why is there a hardcoded api-token for use against JupyterHub's /hub/api endpoint configured here? Even if no JupyterHub is now using this token, it could encourage someone to take the quick and easy way to try by configuring a JupyterHub to accept that API token.

yuvipanda commented 4 years ago

ah, fun. it is a token for a hub that is no longer around, but should kill it...

yuvipanda commented 4 years ago

Has been fixed by #27