access-list: Basic-auth passwords stored and returned in plaintext #17

New Issue

2026-09-14T08:28:30-05:00

blake commented

2026-09-14 08:28:30 -05:00

Why

Access-list AccessItem.Password is stored and compared in plaintext (item.Password == pass with an explicit demo comment). Admin API GET /access-lists and GET /access-lists/{id} JSON-encode the full list including passwords.

Admin JWT is required to read them, and bootstrap/admin default-password issues were already fixed — but anyone with a stolen admin token (or DB file) gets every proxy basic-auth secret in cleartext. Practical bar: hash like the admin password (bcrypt) and redact on read.

Fix direction

Hash on create/update; bcrypt.CompareHashAndPassword in the proxy engine.
API responses omit or mask password fields (write-only).

## Why Access-list `AccessItem.Password` is stored and compared in plaintext (`item.Password == pass` with an explicit demo comment). Admin API `GET /access-lists` and `GET /access-lists/{id}` JSON-encode the full list including passwords. Admin JWT is required to read them, and bootstrap/admin default-password issues were already fixed — but anyone with a stolen admin token (or DB file) gets every proxy basic-auth secret in cleartext. Practical bar: hash like the admin password (bcrypt) and redact on read. ## Fix direction - Hash on create/update; `bcrypt.CompareHashAndPassword` in the proxy engine. - API responses omit or mask password fields (write-only).

blake referenced this issue

2026-09-14 08:32:32 -05:00

access-list: Hash basic-auth passwords and redact API reads #18

eva referenced this issue

2026-09-14 08:40:59 -05:00

access-list: Hash basic-auth passwords and redact API reads #18

eva referenced this issue from a commit

2026-09-14 08:41:02 -05:00

access-list: Hash basic-auth passwords and redact API reads (#18)

eva closed this issue

2026-09-14 08:41:11 -05:00

eva commented