Sitelet https://github.com/dbgate/dbgate/issues/1495
Skip to content

BUG: Sensitive info disclosed on user's browser in localstorage #1495

Description

@Maulinuxops

Describe the bug
After a successful login to a dbGate instance, all the details of the connection, including secrets, are easily shown in localstorage; the "currentDatabase" key contains a JSON string containing hostname, port, username, password...

Such info should NOT reach the client; I believe it's not even needed since the connections are managed server side.

This makes dbGate insecure for use by non-admins and represents a serious security issue.

To Reproduce
Steps to reproduce the behavior:

  1. Log in into any dbGate instance
  2. browsers:
    a. Firefox: press F12 and select "Storage"; on left column select "Local Storage" and select the storage corresponding to the dbGate instance
    b. Chromium/Chrome: press F12 and select "Application"; select Storage/Local Storage and select the storage corresponding to the dbGate instance
  3. see the "currentDatabase" value

Expected behavior
No sensitive information reaches the client

Screenshots
N/A

Version Information (please complete the following information):

  • OS: any
  • App Version latest (v7.2.1)
  • Install source Docker
  • Type - Web
  • Database engine: any

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions