Sensitive information disclosure: OAuth2 client secret exposed in admin settings (not masked)

[supermathie (Michael Brown)]

@Evie_Tao

Is there a plan to mask sensitive fields like OAuth2 secrets in the admin settings UI (e.g., display as ****** with the option to reveal if necessary)?

We don’t consider information disclosure to administrators a problem, but yes it should be marked as sensitive to avoid showing up unnecessariliy, the same as e.g. google_oauth2_client_secret.

This is a simple fix:

FIX: mark oauth2_client_secret as secret

@Evie_Tao

• Administrators are required to directly input the plain secret into the settings. Anyone with access to the admin UI can see the entire secret.
• If an attacker gains access (even temporarily) to an admin session, they could easily obtain the client secret and use it for unauthorized OAuth2 token requests or to forge requests to third-party services.

There’s a tradeoff of secrecy vs. convenience; not allowing the secrets to be unmasked in the UI would only provide an illusion of inaccessibility, there’s other ways for an admin to easily read it from the database.

However, any secrets (any site setting really) can be specified via the environment, then they won’t show up in the admin UI.

(right @pmusaraj?)