Feature #40914
closed
Feature #40907: mgr/dashboard: REST API improvements
mgr/dashboard: REST API: security
Added by Ernesto Puerta almost 5 years ago.
Updated about 3 years ago.
Category:
General - Back-end
Backport:
nautilus, octopus
Description
The following measures should be implemented:
- Failed login limit (after that, the user will be disabled).
- Rate limiting: per-user/token.
- Cache-control private for every response containing personal sensitive information.
- Assignee set to anurag bandhu
- Related to Feature #39999: mgr/dashboard: Prevent brute-force/dictionary attacks against existing local user accounts added
Per our conversation during today's standup, let's split this issue up by moving "Rate limiting: per-user/token" and "Cache-control private for every response containing personal sensitive information" into separate issues and keep the focus of this issue on the limiting failed logins. However, I wonder if this isn't captured in #39999 already?
- Assignee changed from anurag bandhu to Aashish Sharma
- Pull request ID set to 37912
- Status changed from New to Fix Under Review
- Assignee changed from Aashish Sharma to Nizamudeen A
- Pull request ID changed from 37912 to 38316
- Status changed from Fix Under Review to Resolved
- Status changed from Resolved to Pending Backport
- Backport set to octopus, nautilus
- Copied to Backport #48794: octopus: mgr/dashboard: REST API: security added
- Copied to Backport #48795: nautilus: mgr/dashboard: REST API: security added
- Backport changed from octopus, nautilus to octopus
- Backport changed from octopus to nautilus, octopus
Re-adding nautilus to backport field because, without it, the presence of the rejected nautilus backport issue causes the "backport-create-issue" script to complain:
ERROR:root:https://tracker.ceph.com/issues/40914 has more backport issues (,nautilus,octopus) than expected (octopus)
- Status changed from Pending Backport to Resolved
While running with --resolve-parent, the script "backport-create-issue" noticed that all backports of this issue are in status "Resolved" or "Rejected".
- Project changed from mgr to Dashboard
- Category changed from 146 to General - Back-end
Also available in: Atom
PDF