Skip to content

Secure api_key in zuliprc file using encryption#1564

Closed
Gopinath-Mahendiran wants to merge 0 commit intozulip:mainfrom
Gopinath-Mahendiran:Gopinath-Mahendiran
Closed

Secure api_key in zuliprc file using encryption#1564
Gopinath-Mahendiran wants to merge 0 commit intozulip:mainfrom
Gopinath-Mahendiran:Gopinath-Mahendiran

Conversation

@Gopinath-Mahendiran
Copy link

##This PR enhances security by encrypting the api_key stored in the zuliprc file. It ensures that sensitive credentials are not stored in plaintext, reducing the risk of exposure. A decryption mechanism is also included to seamlessly retrieve the api_key when needed.

Outstanding aspect(s)

•	Ensure compatibility with existing zuliprc files containing plaintext api_key.
•	Add documentation for users upgrading to the encrypted format.

Discussed in #zulip-terminal in topic
[ x] Partially fixes issue #1502

How did you test this?

[ x] Manually - Verified that api_key is encrypted when stored.
[ x] Manually - Confirmed api_key decryption works correctly.

###How this behaves
When a user logs in directly from the terminal without downloading the zuliprc file from the web application, the encryption process will be handled internally, ensuring a seamless and secure experience.

However, if the zuliprc file is downloaded from the web application, encryption must be performed manually using the following command:
zulip-term --encrypt <file_name>

This command encrypts the api_key stored in the file, enhancing security before use.

Regardless of whether the user logs in with the default zuliprc file or a custom configuration file, decryption will be handled automatically within the application. This ensures a smooth authentication process without requiring any manual intervention.

@zulipbot zulipbot added the size: XL [Automatic label added by zulipbot] label Mar 22, 2025
@Gopinath-Mahendiran Gopinath-Mahendiran force-pushed the Gopinath-Mahendiran branch 2 times, most recently from e23df1f to 04fd0ae Compare March 24, 2025 04:58
@neiljp
Copy link
Collaborator

neiljp commented Mar 31, 2025

@Gopinath-Mahendiran I replied in the issue, due to some confusion over the specification for the expected fix? I also moved your Zulip message into a new topic to make it easier to see the dedicated discussion for the issue and any PRs that result including this one.

@neiljp neiljp added the PR awaiting update PR has been reviewed & is awaiting update or response to reviewer feedback label Mar 31, 2025
@Gopinath-Mahendiran
Copy link
Author

@neiljp I understand the problem and will work towards it, making the necessary changes.

Additionally, I’d like to clarify whether the key stored by the /usr/bin/key_command should be password-protected or not. Also, should the key-command be a system-wide command or specific to the application?

@zulipbot zulipbot added size: XS [Automatic label added by zulipbot] and removed size: XL [Automatic label added by zulipbot] labels Apr 1, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area: config area: login enhancement New feature or request PR awaiting update PR has been reviewed & is awaiting update or response to reviewer feedback size: XS [Automatic label added by zulipbot]

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants