Describe the bug
After a successful login to a dbGate instance, all the details of the connection, including secrets, are easily shown in localstorage; the "currentDatabase" key contains a JSON string containing hostname, port, username, password...
Such info should NOT reach the client; I believe it's not even needed since the connections are managed server side.
This makes dbGate insecure for use by non-admins and represents a serious security issue.
To Reproduce
Steps to reproduce the behavior:
- Log in into any dbGate instance
- browsers:
a. Firefox: press F12 and select "Storage"; on left column select "Local Storage" and select the storage corresponding to the dbGate instance
b. Chromium/Chrome: press F12 and select "Application"; select Storage/Local Storage and select the storage corresponding to the dbGate instance
- see the "currentDatabase" value
Expected behavior
No sensitive information reaches the client
Screenshots
N/A
Version Information (please complete the following information):
- OS: any
- App Version latest (v7.2.1)
- Install source Docker
- Type - Web
- Database engine: any
Describe the bug
After a successful login to a dbGate instance, all the details of the connection, including secrets, are easily shown in localstorage; the "currentDatabase" key contains a JSON string containing hostname, port, username, password...
Such info should NOT reach the client; I believe it's not even needed since the connections are managed server side.
This makes dbGate insecure for use by non-admins and represents a serious security issue.
To Reproduce
Steps to reproduce the behavior:
a. Firefox: press F12 and select "Storage"; on left column select "Local Storage" and select the storage corresponding to the dbGate instance
b. Chromium/Chrome: press F12 and select "Application"; select Storage/Local Storage and select the storage corresponding to the dbGate instance
Expected behavior
No sensitive information reaches the client
Screenshots
N/A
Version Information (please complete the following information):