Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Provide ability to restrict auth tokens to site, access, scope #15368

Open
tsteur opened this issue Jan 9, 2020 · 0 comments
Open

Provide ability to restrict auth tokens to site, access, scope #15368

tsteur opened this issue Jan 9, 2020 · 0 comments
Labels
c: Security For issues that make Matomo more secure. Please report issues through HackerOne and not in Github. Enhancement For new feature suggestions that enhance Matomo's capabilities or add a new report, new API etc.

Comments

@tsteur
Copy link
Member

tsteur commented Jan 9, 2020

In #6559

I am starting to implement app specific authtokens/passwords.

I started adding some additional features to further increase the security of tokens:

  • Scope: Let users choose if token should be valid for Reporting API, and/or Tracking API, Widgets
  • Access: I was going to let users choose what access the token should have. Eg an admin user could decide the token should have only view or write or admin access (but not super user)
  • Sites: I was going to let the user choose whether the token should have access to all sites, or only one site.

Of course this way you could create different combination of tokens to lower the risk a lot, eg

  • A write token for the tracking API that has only access to one site
  • A reporting token with view permission for only a specific site even though the user is super user or write user or admin user
  • A token for the exported widgets with only view access which has only access for one site

This way, even if a tracker gets the token, the scope of what they can do is quite restricted.

It's tricky to implement though. Eg likely we would need to use completely different Access class depending on whether user is authenticated through UI, or through token_auth. It me mostly done though by changing maybe the behaviour of Access:loadSitesIfNeeded but not sure. Also we would need to check in various places eg in API::index() whether the token is allowed for the current scope etc.

Figured I create separate issue for now to simplify #6559.

@tsteur tsteur added Enhancement For new feature suggestions that enhance Matomo's capabilities or add a new report, new API etc. c: Security For issues that make Matomo more secure. Please report issues through HackerOne and not in Github. labels Jan 9, 2020
@tsteur tsteur added this to the 3.13.1 milestone Jan 9, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
c: Security For issues that make Matomo more secure. Please report issues through HackerOne and not in Github. Enhancement For new feature suggestions that enhance Matomo's capabilities or add a new report, new API etc.
Projects
None yet
Development

No branches or pull requests

2 participants