| ID | Project | Category | View Status | Date Submitted | Last Update |
|---|---|---|---|---|---|
| 0009620 | Taler | merchant backend | public | 2025-03-13 12:27 | 2025-08-31 17:09 |
| Reporter | Dana Dram | Assigned To | schanzen | Resolution deadline | |
| Implementer | Reviewer | ||||
| Release signed by | Deployed by | ||||
| Verifier | Communicator | ||||
| Data protection authority notification required | No | ||||
| CSIRT notification required | No | ||||
| Estimated effort (hours) | Actual effort (hours) | 0 | |||
| Fast-track | No | ||||
| Work package | none | ||||
| Priority | high | Severity | feature | Reproducibility | always |
| Status | closed | Resolution | fixed | ||
| Product Version | 0.14 | ||||
| Target Version | 1.0 stretch goals | Fixed in Version | 1.0 stretch goals | ||
| Summary | 0009620: Restrict public instance access and replace token-based authentication with username and password | ||||
| Description | Currently, the application includes a "Clear" button that makes the instance public, removing the need for a token to log in. This poses a significant security risk, as it allows unrestricted access to the instance without proper authentication. To address this issue, the feature proposes blocking the ability to make the instance public through the "Clear" button. Additionally, instead of relying solely on token-based authentication, the feature suggests replacing it with a more conventional and user-friendly authentication method: username and password. This change would enhance security by ensuring that access is tied to specific user credentials while maintaining ease of use for end-users | ||||
| Additional Information | To prevent making the instance public, it would be preferable to disable or remove the "Clear" button functionality. Additionally, implementing username and password-based authentication as the primary login method would enhance security | ||||
| Tags | security | ||||
- Anonymous