volspotconnect2 ver0.4.0 - Spotify account password retrievable via developer console

[martinbeentjes]

At the office we are using volumio for the radio. We installed Volumio Spotify Connect2 ver0.4.0 to connect to Spotify. I joined the team a while ago, this configuration was in use already for a while.

I wanted to add my own Spotify account so I can control the music. When your spotify credentials are entered and saved, the values stay there even if a full page reload happens.

When another colleague opens the plugin settings, they can retrieve my Spotify password by removing the type="password" attribute in the Developer Console. This is a major password leak.

The credentials should not be filled in automatically

[balbuze]

Just don't use credentials... In that case, no password is stored.
It is only required if you want to be the only user.
But I admit the way password is stored is not safe.

[fbontin]

But this problem is caused by volumio, right? Does it have anything to do with spotify connect?

[balbuze]

Yes. It is because thie plugin stores this setting to avoid to enter credentials each time. But it is saved as text.. it should evolve.

[martinbeentjes]

Just don't use credentials... In that case, no password is stored.

@balbuze I could use the Shared Device option - which was disabled - instead of the user credentials. However, then this issue keeps existing. I think the easiest solution to this, is just removing the user credentials and just use it as a shared device.

[balbuze]

I'm thinking of a workaround to avoid password being displayed... But in that case, the password will be asked if you reconfigure the output in volumio as the plugin script will be regenerated (except if you don't use password)

[martinbeentjes]

I would suggest just not showing the entered username/password. Maybe just a little label "Configured via credentials" or something like that. And then a button "Change" to let the user configure the user credentials?

[balbuze]

an other way would be to not store in "clear" password... I will discuss with Michelangelo of this because it a problem for all plugins requiring credentials, not only voslptoconnect