Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

Bug 1388770

Summary:	Better to have a link to hide the token again after unfolded on Command Line Tools page
Product:	OpenShift Container Platform	Reporter:	XiaochuanWang <xiaocwan>
Component:	Management Console	Assignee:	Juan Vallejo <jvallejo>
Status:	CLOSED ERRATA	QA Contact:	Yadan Pei <yapei>
Severity:	low	Docs Contact:
Priority:	medium
Version:	3.4.0	CC:	aos-bugs, jforrest, jokerman, jvallejo, mmccomas, tdawson
Target Milestone:	---
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:	Cause: Unable to hide user token after clicking link to display it in the example cli commands on the web console. Consequence: User could not hide sensitive information (the token) once it was displayed, unless the page was refreshed. Fix: web console page containing command line examples was updated so that each command line example was displayed in an input element, with a "copy to clipboard" button. This allowed for the cli example containing a user's token to never show the token, but rather have the "copy to clipboard" button directly copy it to the user's clipboard. Result: There is no longer an issue of a user's token being displayed, without a way to hide it again.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2017-04-12 19:15:29 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description XiaochuanWang 2016-10-26 07:35:12 UTC

Description of problem:
User login web console and go to https://xxx:8443/console/command-line, click "...click to show token..." and try to find a way to hide token again.

Version-Release number of selected component (if applicable):
openshift v3.4.0.15+9c963ec

How reproducible:
Always

Steps to Reproduce:
1. User login web console and go to https://xxx:8443/console/command-line
2. Click to show token in the line "oc login https://xxx:8443 --token=...click to show token..."
3. Try to find a way to hide token again.

Actual results:
User can not hide the token which is sensitive. 

Expected results:
User can fold token again.

Additional info:
Can work around by refreshing the web page, but may not working when network is bad for refresh and even hung.

Comment 1 Juan Vallejo 2016-11-14 21:14:32 UTC

Related PR: https://github.com/openshift/origin-web-console/pull/871

Comment 2 Troy Dawson 2017-01-20 23:20:44 UTC

This has been merged into ocp and is in OCP v3.5.0.7 or newer.

Comment 3 XiaochuanWang 2017-01-22 06:01:50 UTC

Verified on openshift 3.5.0.7

Page shows "oc login https://x.x.x.x:8443 --token=<token>" with a warning "A token is a form of a password. Do not share your API token."

User could still get the token by copying it

Comment 5 errata-xmlrpc 2017-04-12 19:15:29 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2017:0884