-
Bug
-
Resolution: Won't Fix
-
Minor
Trigger builds remotely/authentication token is a textbox. If you use per-project based security and enabled extended read, the token isn't obfuscated.
Could you turn the textbox to a password field?
I understand it is a corner case but the authentication token should be considered a password IMO.
Not a bug.
If it were a password box, there would be no way to get its current value, so that's impractical. (This isn't a use case with passwords to external systems, so there's no problem there)
Workaround: Don't assign Extended Read permissions on remotely triggerable projects to untrusted users. Trigger the job in question differently e.g. as downstream job from a non-ExtendedReadable, but remotely triggerable job, or using real HTTP auth (username + API token).