[Vulnerability] Visible github token

[thomaslprru]

Hi, 

I just observed that the Dataiku interface keeps the GitHub token visible when cloning plugin from remote repository (see below). 

For security purposes, is it possible to hide it as it already exists when setting up the remote branch in plugin development mode (see below).

Thanks in advance,

Thomas

---

Operating system used: Windows

[AlexT]

Hi @thomaslprru ,

It would better if can open support so we can better track this question.

You don't have to use the credentials/token in the remote origin URL directly. You should use SSH Keys or cached https credentials instead. Various options are detailed here:

https://stackoverflow.com/questions/46645843/where-to-store-my-git-personal-access-token

https://stackoverflow.com/questions/10054318/how-do-i-provide-a-username-and-password-when-running-g...

Thanks

[tgb417]

@thomaslprru 

Once you figure out what you think the best approach is for this.  I'd love to hear what you conclude the best approach would be.

[thomaslprru]

Hi,

Thanks for the answers. I decided to use https credentials cache because it was the easiest method to implement.