in case any of you also runs the Horizon dashboard. federico Dr. Federico Michele Facca Head of Martel Lab Martel Innovate Dorfstrasse 73 - 3073 Gümligen (Switzerland) 0041 78 807 58 38 0041 31 994 25 25 martel-innovate.com <http://martel-innovate.com/> > Begin forwarded message: > > From: Luke Hinds <lhinds at redhat.com> > Subject: [Openstack] [OSSN-0073] Horizon dashboard leaks internal information through cookies > Date: 8 September 2016 at 22:38:17 GMT+2 > To: openstack at lists.openstack.org, openstack-dev at lists.openstack.org > > Horizon dashboard leaks internal information through cookies > --- > > ### Summary ### > When horizon is configured, its URL contains the IP address of > the internal URL of keystone, as the default value for the identity > service is "internalURL".[1] > > The cookie "login_region" will be set to the value configured as > OPENSTACK_KEYSTONE_URL, given in the local_settings.py file. > > Usually, the OPENSTACK_KEYSTONE_URL is the publicURL, and hence the > cookie URL will also be the public one. If set to internal URL (by > default), then the login cookie URL will be the internal URL or IP. So, > by putting the OPENSTACK_KEYSTONE_URL in the cookie that is sent to > the public network, horizon leaks the values of the internal network IP > address. > > ### Affected Services and Software ### > Horizon > > ### Discussion ### > This is not a bug in horizon, but a possible misconfiguration issue. > > Exposing the internal URL is not a bug, since one can view the internal > URL as it's a freely accessible endpoint to authorized users, or it's > hidden behind a firewall. Also, the data for internal URLs are freely > available in the catalog and the catalog is not considered private > information. > > ### Contacts / References ### > Author: Khanak Nangia, Intel > This OSSN : https://wiki.openstack.org/wiki/OSSN/OSSN-0073 > Original LaunchPad Bug : https://bugs.launchpad.net/ossn/+bug/1585831 > Related bug : https://bugs.launchpad.net/horizon/+bug/1597864 > OpenStack Security ML : openstack-dev at lists.openstack.org > OpenStack Security Group : https://launchpad.net/~openstack-ossg > [1]: http://docs.openstack.org/developer/horizon/topics/settings.html > ______________________________________________ > Mailing list: http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack > Post to : openstack at lists.openstack.org > Unsubscribe : http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack -------------- next part -------------- An HTML attachment was scrubbed... URL: <https://lists.fiware.org/private/fiware-lab-federation-nodes/attachments/20160909/70546e32/attachment.html>
You can get more information about our cookies and privacy policies clicking on the following links: Privacy policy Cookies policy