Stop exposing service tokens via process command-line arguments - #23
Merged
Merged
Conversation
Command-line arguments are visible to other users on the same host via ps/proc, so --token-password "$TOKEN" leaked the token. marimo already supports --token-password-file, and both entrypoint.sh and https-wrap.sh already persist the token to a file, so switch to that instead. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
ttyd's own -c user:pass auth has no env-var or credential-file option (tsl0922/ttyd#872), so the terminal token was passed on ttyd's command line -- visible to other users on the host via ps. Caddy now performs the Basic Auth check itself (basic_auth with a bcrypt hash generated via stdin, never on argv) and forwards a static trust header to ttyd, which runs in its -H/--auth-header auth-proxy mode instead of -c. Verified live: caddy_start's generated Caddyfile enforces Basic Auth (200 for correct creds, 401 for wrong) and ttyd in -H mode requires the injected header (407 without it, 200 with it). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
4 tasks
5 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
A security review found that the marimo and web-terminal (ttyd) service tokens were passed as plain command-line arguments to subprocesses, which are visible to other users on the same host via
ps//proc/<pid>/cmdline.--token-password "$TOKEN"to--token-password-file <path>(marimo already supports this; both wrappers already persist the token to a file).-c user:passBasic Auth (unimplemented upstream: Allow specifying HTTP basic auth credentials from a file tsl0922/ttyd#872), so Basic Auth is now enforced by the fronting Caddy proxy (basic_authwith a bcrypt hash, hashed via stdin so it never appears oncaddy's argv either), and ttyd runs in its-H/--auth-headerauth-proxy trust mode instead of-c.Test plan
bash -non all four modified scripts--token-password-filecaddy_hash_password+caddy_start's newbasic_auth/header_upCaddyfile block against a running Caddy instance: correct credentials over HTTPS → 200, wrong credentials → 401-Hauth-proxy mode: request without the trusted header → 407, with it → 200pixi run marimo-httpsandpixi run terminal-httpsin a real Fileglancer job, confirming no token appears inps auxwwoutput for either service🤖 Generated with Claude Code