Secure VRAConnect

[martin9700]

Steps to reproduce

$Global:vraconnection
Server : https://server.domain.local Token : <token> RefreshToken : <refreshtoken> APIVersion : 2019-01-15 SignedCertificates : False SslProtocol : Default

Expected behavior

$Global:vraconnection

Also: $Script:vraconnection

[Stevio54]

could you detail out the issue please?

[martin9700]

Sure, when you Connect-VraServer, you can simply type $Global:VraConnection and see both tokens required for accessing VRA. It would certainly be possible for someone to walk up , get those tokens then start doing work AS YOU. Attack surface area is pretty low, but it's simple to fix so why not?

I can submit a PR if you'd like?

[Stevio54]

Thanks for clarifying the issue. Would it be possible for you to submit a PR?

[jonathanmedd]

Thanks for this! I didn't realise until today that “script scope in a module is module scope” otherwise we would have done this from the beginning :-)

[martin9700]

Right?! As soon as I read about it I switched all my modules to use that!