8000 OIDC access token exposed via "coder state pull" · Issue #10000 · coder/coder · GitHub
[go: up one dir, main page]

Skip to content
OIDC access token exposed via "coder state pull" #10000
Closed as not planned
Closed as not planned
@aaronlehmann

Description

@aaronlehmann

We noticed that the state returned by coder state pull includes the OIDC access token: https://registry.terraform.io/providers/coder/coder/latest/docs/data-sources/workspace#owner_oidc_access_token

While it seems reasonable to store this token for internal use, it probably shouldn't be exposed through the API/CLI. It would be easy to accidentally log or persist the token when using coder state pull for an unrelated purpose.

Would it be possible to redact this from the data returned by this API?

Metadata

Metadata

Assignees

No one assigned

    Labels

    bug riskProne to bugsstaleThis issue is like stale bread.

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions

      0