[Openstack-security] [Bug 1197459] Change abandoned on nova (master)
Change abandoned by Balazs Gibizer (balazs.gibizer at est.tech) on branch: master
Reason: @Matt: thanks for the pointer. I will work on https://review.opendev.org/#/c/220622 instead.
You received this bug notification because you are a member of OpenStack
Security SIG, which is subscribed to OpenStack.
noVNC contains the session token in URL and insecurely sets the
Status in OpenStack Compute (nova):
Status in OpenStack Security Advisory:
The VNC Console connection in Nova works by having the user connect to
the API which returns a URL such as:
https://example.com:443/?token=abc Where the token has a TTL which is
then used to create a session from a WebSocket. However, URL's should
not contain sensitive information such as session tokens with a TTL
since URL's can be leaked through proxy logs or other types of attacks
such as Cross-Site Scripting. Additionally, due to the session cookie
it set with the Secure flag making it further susceptible to Cross-
Site Scripting attacks or leakage through a non-SSL connection. To
limit the exposure of the token being leaked through the URL the
returned token from the API should be of a one-time use and only used
as an authentication token in order to obtain a session. The session
cookie should be set by a Web Service instead of the client in order
to securely set the cookie with the HttpOnly flag to be set in
addition to setting the Secure flag.
To manage notifications about this bug go to: