[Labs-l] Storing oauth tokens in a tool account

[Bryan Davis]

On Thu, Feb 2, 2017 at 8:40 PM, Sam Wilson <sam at samwilson.id.au> wrote:
> The file itself is written by the web server user (which is always the
> same as the tool account isn't it?) and then chmod'd 0660. Is that
> enough?

If you write the contents and then chmod there is a small race
condition introduced where the data might be visible to another
user/process. To make sure that others can not see the file contents
you should:
* create an empty file: touch( $file ) [0]
* make the file readable only by the web server process: chmod( $file,
0600 ) [1]
* write the token to the file: file_put_contents( $file, $token )

Obviously adjust for the proper functions if your implementation
language is not PHP.

You should probably also cron some periodic cleanup function to purge
files that might be leaked in the case of an unhandleable error in
your uploader process. In my opinion it would be easier to use a
database table. :)

[0]: https://secure.php.net/touch
[1]: https://secure.php.net/chmod
[2]: https://secure.php.net/file_put_contents

Bryan
-- 
Bryan Davis              Wikimedia Foundation    <bd808 at wikimedia.org>
[[m:User:BDavis_(WMF)]]  Sr Software Engineer            Boise, ID USA
irc: bd808                                        v:415.839.6885 x6855