Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Prohibiting Default Username and Password Logins. #6396

Open
slievrly opened this issue Mar 6, 2024 · 2 comments · May be fixed by #7261
Open

Prohibiting Default Username and Password Logins. #6396

slievrly opened this issue Mar 6, 2024 · 2 comments · May be fixed by #7261
Labels
task: help-wanted Extra attention is needed

Comments

@slievrly
Copy link
Member

slievrly commented Mar 6, 2024

After the initial setup of the console, the first login should redirect to a page for initializing the account and password, where data or configuration can be persisted. Subsequently, due to security concerns, the login using default accounts and passwords should be disabled.
@slievrly slievrly added the task: help-wanted Extra attention is needed label Mar 6, 2024
@YongGoose
Copy link
Contributor

@slievrly

I'm interested in this issue. Could you provide more information?

@slievrly
Copy link
Member Author

slievrly commented Mar 9, 2025

Right now, the Seata console uses a username and password for login, with the default being seata/seata. A lot of users don’t change these default credentials in the config files when setting things up, and then deploy it to public-facing environments. This leaves the door wide open for unauthorized folks to log in with the default info and snoop around.

Here’s the fix we’re thinking: Add an interactive script or setup wizard during installation that forces users to either input or auto-generate their own username, password, and secret key on first launch. That way, there’s no default sensitive info hanging around, and the system stays way more secure.

@YongGoose YongGoose linked a pull request Mar 31, 2025 that will close this issue
Open
1 task
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
task: help-wanted Extra attention is needed
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Feature: enforce account initialization and disable default credentials YongGoose/incubator-seata
2 participants
@slievrly @YongGoose