Bug 1388770 – Better to have a link to hide the token again after unfolded on Command Line Tools page

Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.

Bug 1388770 - Better to have a link to hide the token again after unfolded on Command Line Tools page

Summary:	Better to have a link to hide the token again after unfolded on Command Line ...

Status:	CLOSED ERRATA

Aliases:	None

Product:	OpenShift Container Platform
Classification:	Red Hat
Component:	Management Console (Show other bugs)
Sub Component:
Version:	3.4.0
Hardware:	Unspecified Unspecified

Priority	medium Severity low
Target Milestone:	---
Target Release:	---
Assigned To:	Juan Vallejo
QA Contact:	Yadan Pei
Docs Contact:

URL:
Whiteboard:
Keywords:

Depends On:
Blocks:
	Show dependency tree / graph

Reported:	2016-10-26 03:35 EDT by XiaochuanWang
Modified:	2017-07-24 10 EDT (History)
CC List:	6 users (show)

See Also:
Fixed In Version:
Doc Type:	Bug Fix
Doc Text:	Cause: Unable to hide user token after clicking link to display it in the example cli commands on the web console. Consequence: User could not hide sensitive information (the token) once it was displayed, unless the page was refreshed. Fix: web console page containing command line examples was updated so that each command line example was displayed in an input element, with a "copy to clipboard" button. This allowed for the cli example containing a user's token to never show the token, but rather have the "copy to clipboard" button directly copy it to the user's clipboard. Result: There is no longer an issue of a user's token being displayed, without a way to hide it again.
Story Points:	---
Clone Of:
Environment:
Last Closed:	2017-04-12 15:15:29 EDT
Type:	Bug
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

External Trackers
Tracker	ID	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHBA-2017:0884	normal	SHIPPED_LIVE	Red Hat OpenShift Container Platform 3.5 RPM Release Advisory	2017-04-12 18:50:07 EDT

Groups: None (edit)

Description XiaochuanWang 2016-10-26 03:35:12 EDT

Description of problem:
User login web console and go to https://xxx:8443/console/command-line, click "...click to show token..." and try to find a way to hide token again.

Version-Release number of selected component (if applicable):
openshift v3.4.0.15+9c963ec

How reproducible:
Always

Steps to Reproduce:
1. User login web console and go to https://xxx:8443/console/command-line
2. Click to show token in the line "oc login https://xxx:8443 --token=...click to show token..."
3. Try to find a way to hide token again.

Actual results:
User can not hide the token which is sensitive. 

Expected results:
User can fold token again.

Additional info:
Can work around by refreshing the web page, but may not working when network is bad for refresh and even hung.

Comment 1 Juan Vallejo 2016-11-14 16:14:32 EST

Related PR: https://github.com/openshift/origin-web-console/pull/871

Comment 2 Troy Dawson 2017-01-20 18:20:44 EST

This has been merged into ocp and is in OCP v3.5.0.7 or newer.

Comment 3 XiaochuanWang 2017-01-22 01:01:50 EST

Verified on openshift 3.5.0.7

Page shows "oc login https://x.x.x.x:8443 --token=<token>" with a warning "A token is a form of a password. Do not share your API token."

User could still get the token by copying it

Comment 5 errata-xmlrpc 2017-04-12 15:15:29 EDT

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2017:0884

Note You need to log in before you can comment on or make changes to this bug.