Skip to content

Commit

Permalink
Close #388: Prevent web browser from remembering API keys
Browse files Browse the repository at this point in the history
  • Loading branch information
@TheSomeMan
TheSomeMan committed May 10, 2024
1 parent 36c3827 commit 731f05f
Show file tree
Hide file tree
Showing 5 changed files with 72 additions and 15 deletions.
7 changes: 4 additions & 3 deletions src/gui_input_token.mjs
View file
Original file line number Diff line number Diff line change
Expand Up @@ -3,19 +3,20 @@
* @copyright Ruuvi Innovations Ltd, license BSD-3-Clause.
*/

import GuiInputTextWithSaving from './gui_input_text_with_saving.mjs'
import GuiInputPassword from "./gui_input_password.mjs";
import * as crypto from './crypto.mjs'

class GuiInputToken extends GuiInputTextWithSaving {
class GuiInputToken extends GuiInputPassword {

constructor (obj, useSavedToken = true) {
super(obj, useSavedToken, 'text', 'GuiInputToken')
super(obj, useSavedToken, 'password', 'GuiInputToken')
}

setNewTokenIfEmpty () {
if (this._obj.val() === '') {
this._clear_saved()
this._obj.val(crypto.enc.Base64.stringify(crypto.SHA256(crypto.lib.WordArray.random(32))))
this.showPassword()
}
}
}
Expand Down
64 changes: 52 additions & 12 deletions src/index.html
View file
Original file line number Diff line number Diff line change
Expand Up @@ -1115,7 +1115,13 @@ <h3>
</label>
</h3>
<div class="input-password input-with_validity_check">
<input type="text" id="remote_cfg-auth_bearer-token">
<input type="password" id="remote_cfg-auth_bearer-token">
<div class="input-password-eye">
<div class="eye">
</div>
<div class="eye-slash hidden">
</div>
</div>
<div class="input-with_validity_check-icon">
</div>
<div class="input-placeholder">
Expand Down Expand Up @@ -1693,10 +1699,18 @@ <h3>
<span lang="fi">API-avain (haltijatunnus)</span>
</label>
</h3>
<input type="text" id="lan_auth-api_key">
<div class="input-placeholder">
<span lang="en">API key</span>
<span lang="fi">API-avain</span>
<div class="input-password">
<input type="password" id="lan_auth-api_key">
<div class="input-password-eye">
<div class="eye hidden">
</div>
<div class="eye-slash">
</div>
</div>
<div class="input-placeholder">
<span lang="en">API key</span>
<span lang="fi">API-avain</span>
</div>
</div>
</div>
</div>
Expand All @@ -1716,10 +1730,18 @@ <h3>
<span lang="fi">API-avain (haltijatunnus)</span>
</label>
</h3>
<input type="text" id="lan_auth-api_key_rw">
<div class="input-placeholder">
<span lang="en">API key</span>
<span lang="fi">API-avain</span>
<div class="input-password">
<input type="password" id="lan_auth-api_key_rw">
<div class="input-password-eye">
<div class="eye">
</div>
<div class="eye-slash hidden">
</div>
</div>
<div class="input-placeholder">
<span lang="en">API key</span>
<span lang="fi">API-avain</span>
</div>
</div>
</div>
</div>
Expand Down Expand Up @@ -1992,7 +2014,13 @@ <h3>
</label>
</h3>
<div class="input-password input-with_validity_check">
<input type="text" id="http_auth_bearer_api_key">
<input type="password" id="http_auth_bearer_api_key">
<div class="input-password-eye">
<div class="eye">
</div>
<div class="eye-slash hidden">
</div>
</div>
<div class="input-with_validity_check-icon">
</div>
<div class="input-placeholder">
Expand All @@ -2017,7 +2045,13 @@ <h3>
</label>
</h3>
<div class="input-password input-with_validity_check">
<input type="text" id="http_auth_token_api_key">
<input type="password" id="http_auth_token_api_key">
<div class="input-password-eye">
<div class="eye">
</div>
<div class="eye-slash hidden">
</div>
</div>
<div class="input-with_validity_check-icon">
</div>
<div class="input-placeholder">
Expand All @@ -2042,7 +2076,13 @@ <h3>
</label>
</h3>
<div class="input-password input-with_validity_check">
<input type="text" id="http_auth-api_key-value">
<input type="password" id="http_auth-api_key-value">
<div class="input-password-eye">
<div class="eye">
</div>
<div class="eye-slash hidden">
</div>
</div>
<div class="input-with_validity_check-icon">
</div>
<div class="input-placeholder">
Expand Down
12 changes: 12 additions & 0 deletions src/page_custom_server.mjs
View file
Original file line number Diff line number Diff line change
Expand Up @@ -462,6 +462,12 @@ class PageCustomServer {

async #onHide() {
console.log(log_wrap('section#page-custom_server: onHide'))
this.#input_http_auth_basic_pass.hidePassword()
this.#input_http_auth_bearer_token.hidePassword()
this.#input_http_auth_token_api_key.hidePassword()
this.#input_http_auth_apikey_value.hidePassword()
this.#input_mqtt_pass.hidePassword()
this.#input_http_stat_pass.hidePassword()
this.#gwCfg.http.use_http_ruuvi = this.#checkbox_use_http_ruuvi.isChecked()
this.#gwCfg.http.use_http = this.#checkbox_use_http.isChecked()
if (this.#checkbox_use_http.isChecked()) {
Expand Down Expand Up @@ -1214,6 +1220,12 @@ class PageCustomServer {
}

async #onButtonCheck() {
this.#input_http_auth_basic_pass.hidePassword()
this.#input_http_auth_bearer_token.hidePassword()
this.#input_http_auth_token_api_key.hidePassword()
this.#input_http_auth_apikey_value.hidePassword()
this.#input_mqtt_pass.hidePassword()
this.#input_http_stat_pass.hidePassword()
if (!this.#input_http_url.getVal().startsWith('http://') && !this.#input_http_url.getVal().startsWith('https://')) {
this.#input_http_url.setVal('http://' + this.#input_http_url.getVal())
this.#input_http_url.setValidationRequired()
Expand Down
2 changes: 2 additions & 0 deletions src/page_lan_auth.mjs
View file
Original file line number Diff line number Diff line change
Expand Up @@ -145,6 +145,8 @@ class PageLanAuth {

async #onHide () {
console.log(log_wrap('section#page-settings_lan_auth: onHide'))
this.#input_api_key.hidePassword()
this.#input_api_key_rw.hidePassword()
if (this.#radio_lan_auth_type_default.isChecked()) {
this.#gwCfgLanAuth.lan_auth_type.setAuthDefault()
this.#gwCfgLanAuth.setDefaultUser()
Expand Down
2 changes: 2 additions & 0 deletions src/page_remote_cfg.mjs
View file
Original file line number Diff line number Diff line change
Expand Up @@ -175,6 +175,8 @@ class PageRemoteCfg {

async #onHide() {
console.log(log_wrap('section#page-remote_cfg: onHide'))
this.#input_auth_basic_pass.hidePassword()
this.#input_auth_bearer_token.hidePassword()
this.#updateGwCfg()
}

Expand Down

0 comments on commit 731f05f

Please sign in to comment.