Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Allow to use the command through non-localhost environment #676

Closed
shavounet opened this issue Jan 25, 2018 · 2 comments
Closed

Allow to use the command through non-localhost environment #676

shavounet opened this issue Jan 25, 2018 · 2 comments

Comments

@shavounet
Copy link

I've tried to use the CLI with docker, but I couldn't use some commands like platform login due to the php server being binded to localhost :
https://github.com/platformsh/platformsh-cli/blob/8f2669e4d17aaee9cce94b335562b496e1e87421/src/Command/Auth/BrowserLoginCommand.php#L65

Ideally, in this place (and maybe others), it should be configurable (through an ENV variable for example).

Test case : create a simple image (ubuntu with php, git, ssh, ...), install the CLI inside the image, and start a new container with the command platform login and correct port mapping. It should display normal output, but when going on http://localhost:5000/ the connection is marked as closed by remote.

Workaround : I use an API token, but I don't know if there is an other place where this might lead to issues

@pjcdawkins
Copy link
Collaborator

pjcdawkins commented Jan 26, 2018

Security-wise, it absolutely needs to be on the local loopback interface (127.0.0.1 rather than localhost), so that it doesn't need requests over the network, and so that it can't be served by an external host (e.g. by a malicious attacker somehow taking over localhost via DNS).

The platform auth:password-login command is available for non-browser usage. That's also configurable as the default interactive "login method", mentioned here: https://github.com/platformsh/platformsh-cli#customization

@pjcdawkins
Copy link
Collaborator

The presence of auth:password-login and this upcoming help message should resolve this issue:
8baebb4

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants