Add warning that REST API is not safe for multi-user use

closes #6692 https://pulp.plan.io/issues/6692
pulp · May 26, 2020 · 8c3a6da · 8c3a6da
1 parent 8817d13
commit 8c3a6da
Show file tree

Hide file tree

Showing 5 changed files with 15 additions and 1 deletion.
diff --git a/CHANGES.rst b/CHANGES.rst
@@ -9,7 +9,11 @@ Changelog
     To add a new change log entry, please see
     https://docs.pulpproject.org/contributing/git.html#changelog-update
 
-    WARNING: Don't drop the next directive!
+    WARNING: Don't drop the towncrier directive!
+
+.. warning::
+    Until Role-Based Access Control is added to Pulp, REST API is not safe for multi-user use.
+    Sensitive credentials can be read by any user, e.g. ``Remote.password``, ``Remote.client_key``.
 
 .. towncrier release notes start
 

diff --git a/CHANGES/6692.doc b/CHANGES/6692.doc
@@ -0,0 +1 @@
+Added a warning that the REST API is not safe for multi-user use until RBAC is implemented.
diff --git a/docs/components.rst b/docs/components.rst
@@ -29,6 +29,9 @@ things:
 
       $ pulpcore-manager runserver 24817
 
+.. warning::
+    Until Role-Based Access Control is added to Pulp, REST API is not safe for multi-user use.
+    Sensitive credentials can be read by any user, e.g. ``Remote.password``, ``Remote.client_key``.
 
 The REST API can be deployed with any any WSGI webserver like a normal Django application. See the
 `Django deployment docs <https://docs.djangoproject.com/en/2.1/howto/deployment/wsgi/>`_ for more

diff --git a/docs/installation/authentication.rst b/docs/installation/authentication.rst
@@ -10,6 +10,9 @@ username and password against the internal users database.
     This authentication is only for the REST API. Client's fetching binary data have their identity
     verified and authorization checked using a :term:`ContentGuard`.
 
+.. warning::
+    Until Role-Based Access Control is added to Pulp, REST API is not safe for multi-user use.
+    Sensitive credentials can be read by any user, e.g. ``Remote.password``, ``Remote.client_key``.
 
 Which URLs Require Authentication?
 ----------------------------------

diff --git a/docs/rest_api.rst b/docs/rest_api.rst
@@ -5,6 +5,9 @@ REST API
 
     The REST API documentation is `here <restapi.html>`_.
 
+.. warning::
+    Until Role-Based Access Control is added to Pulp, REST API is not safe for multi-user use.
+    Sensitive credentials can be read by any user, e.g. ``Remote.password``, ``Remote.client_key``.
 
 The documentation is auto generated based on the OpenAPI schema for the REST API. The hosted
 documentation is broken up between ``pulpcore`` and each of the plugin's documentation sites.