Actions
Bug #22552
open
Token shell copy+paste doesn't work as intended, leaks token on modern terminals
Status:
New
Priority:
Normal
Assigned To:
-
Category:
Workbench2
Target version:
-
Story points:
-
Description
On the "Get API Token" page there's a button to copy shell commands like this:
HISTIGNORE=$HISTIGNORE:'export ARVADOS_API_TOKEN=*' export ARVADOS_API_TOKEN=v2/… export ARVADOS_API_HOST=jutro.arvadosapi.com unset ARVADOS_API_HOST_INSECURE
The idea is you paste this block into a shell and then client tools are configured to contact that cluster.
But if you have a modern terminal that supports multi-line paste, this doesn't work as intended. The entire block gets pasted and enters your history as a single command. This means the command does not match the $HISTIGNORE configuration and the token gets logged in your shell history.
Off the top of my head I do not know a way to accomplish the thing we're trying to accomplish here that works reliably across different shells and terminals.
Updated by Brett Smith about 2 months ago
- Related to Idea #21847: "Get API Token" usability improvements added
Actions