ivpn light: why is private key being sent to the server?

[maan2003]

just trying to understand the api

ivpn.net/src/themes/ivpn-v3/assets/js/api/api.js

Lines 414 to 420 in 406e03c

	let response = await this.Post('/web/accounts/btc/create-light-invoice', {
	price_id: priceID,
	private_key: privateKey,
	public_key: publicKey,
	exit_server: exitServer,
	entry_server: entryServer
	})

[nathanrod]

Thanks for the report, the private key is actually not used in our backend since it is not required for the account deployment. The Wireguard private key is only used in the client config settings that is available in the client browser session.
A PR has been created and merged.

[maan2003]

Thanks.

[maan2003]

looks like private key is still being sent to server, these js cookies are being sent to the server

ivpn.net/src/themes/ivpn-v3/assets/js/views/OnePageCheckout.vue

Line 345 in ca475ac

JSCookie.set('lpv', this.privateKey, { expires: 0.5, })

please reopen this issue or I can open new one.

[nathanrod]

If you check the api request implementation, although there is a reference, the private key is never sent to our backend :

ivpn.net/src/themes/ivpn-v3/assets/js/api/api.js

Line 409 in ca475ac

async createLightInvoice(priceID, exitServer, entryServer, privateKey, publicKey) {

Regarding storing the private key in a cookie with an expire time in the client browser, it is required to be able to generate the config files when a payment is completed since it is not stored in our backend to fetch it:

ivpn.net/src/themes/ivpn-v3/assets/js/views/Account/ThankYouLight.vue

Line 124 in ca475ac

"\nPrivateKey = " + JSCookie.get('lpv') +

The whole logic can be verified at https://www.ivpn.net/light/ .

[maan2003]

you should use local stoarge for storing this.

cookies are implicitly sent to the server with every request to https://ivpn.net, I can see it being sent as Cookie: header in the network tab

[nathanrod]

The main issue with using localstorage is that it is persistent until the client deletes it or the app force a deletion ( which may create issues when trying to download the config for a second time) for temporal accounts.

I will have a meeting with the team to review the current logic, until then i will keep the issue opened.