Closed Bug 903265 Opened 12 years ago Closed 10 years ago

SharedSecret can't be changed

Categories

(Marketplace Graveyard :: API, defect, P2)

Product:
Marketplace Graveyard
Component:
API
Platform:
x86
macOS
Type:
defect

Tracking

(Not tracked)

Status:
RESOLVED WONTFIX

People

(Reporter: andy+bugzilla, Assigned: ashort)

Details

(Whiteboard: [ktlo][possible_future_need])

I think, the SharedSecret is a combination of email and settings.SECRET_KEY. But thats it. Which means that if a SharedSecret gets shared, which given its use in the URLs could happen, there's no way to reset it. Perhaps the SharedSecret should contain a third element which can be changed, such as a unique uuid for a user. We could rotate that uuid or change it... at worst that will cause the user to be logged out until they log back in.
See mkt.account.api.LoginResource.get_token -- secret key is based on email, secret key, and a random UUID.
... But the UUID is passed as plaintext and not stored, so it doesn't distinguish the user.
Priority: -- → P3
Assignee: nobody → ashort
Priority: P3 → P2
Whiteboard: [ktlo][possible_future_need]
Status: NEW → RESOLVED
Closed: 10 years ago
Resolution: --- → WONTFIX
You need to log in before you can comment on or make changes to this bug.