You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Is your feature request related to a problem? Please describe.
As of v1.0.0 the passwords for the local-file auth provider are stored in clear text in a YAML file on disk.
This is not good at all from a security point of view.
Better would be to store a hashed and salted version of the passwords in the YAML file.
Describe the solution you'd like
Add an option to the local-file auth provider in the main YAML config file.
Something like:
localFile: # "Local file" provider reads user data from a file on diskenable: falsehashPassword: trueurl: https://<FQDN>:8081 # URL where login UI for this provider is availableuserDirectory: lab # Qlik Sense user directory that will be used for the authenticated useruserFile: ./config/users.yaml # YAML file containing usernames and passwords
The default (if the hashPassword field is not specified) would be to require hashed passwords.
If someone really don't want hashed passwords they can set the field to false.
NOTE: This would be a breaking change as the default as of version 1.0 is that passwords are NOT hashed.
Use an established, proven hashing library instead of inventing something new.
The text was updated successfully, but these errors were encountered:
Is your feature request related to a problem? Please describe.
As of v1.0.0 the passwords for the local-file auth provider are stored in clear text in a YAML file on disk.
This is not good at all from a security point of view.
Better would be to store a hashed and salted version of the passwords in the YAML file.
Describe the solution you'd like
Add an option to the local-file auth provider in the main YAML config file.
Something like:
The default (if the hashPassword field is not specified) would be to require hashed passwords.
If someone really don't want hashed passwords they can set the field to
false
.NOTE: This would be a breaking change as the default as of version 1.0 is that passwords are NOT hashed.
Use an established, proven hashing library instead of inventing something new.
The text was updated successfully, but these errors were encountered: