[PATCH 1/4] Add a api_login field

seth vidal skvidal at fedoraproject.org
Wed Mar 20 06:13:56 UTC 2013


On Tue, 12 Mar 2013 08:10:21 +0100
Pierre-Yves Chibon <pingou at pingoured.fr> wrote:

> On Tue, 2013-03-12 at 03:07 -0400, Bohuslav Kabrda wrote:
> > A question for this series. If I understand it correctly, the
> > api_login is just another random generated string, right? Would you
> > please elaborate a bit more on why having separate logins is good?
> 
> Yes it is, (with the addition that that the part before '##' is a
> based64 of 'copr').
> I think the basic idea here is to reduce even more the possibility of
> brute force since one would have to do it for both the api token and
> the username. Seth, do you see another interest for it?
> 
> It also seems to be the approach taken by cloud plateform and by oauth
> system (if my understanding is correct).
> 

That's correct. I think the idea is that if someone discovers your
token they don't discover who owns it but if we find someone using that
token username somewhere else - we can trace back what app it came from.

-sv


More information about the copr-devel mailing list