Feature request: dynamic tokens for webvnc console link

[lord-kyron]

@Real-Gecko @catborise - can you guys make the tokens on the webvnc console link (the token in the browser link) to STOP to be static (per vm) and to be generated automatically dinamic every time a new webvnc console is requested. This way it will prevent a person knowing the exact link (including the token) and open directly the vnc console. If it is dynamic - once you request a webvnc window (from the connect button) a new link and token are generated and once you close the window (the vnc connection) the old token have to expire. What do you think?

[lord-kyron]

@catborise - will this be something possible to implement?

[catborise]

uuid is primary key for instances. it could not change.
if someone has an user credentials he should access any instance.

but there is a glitch i think. someone is not an admin but only a user and it has a uuid info and host info. it could access someone's instance console... i think it is a security issue. we should control if user has ownership or not...

nice catch... my view is that it is a security issue...
we should provide a security to prevent that situation.

[lord-kyron]

Yes, that was what I meant when i opened this request. I already had traces in the past of someone trying to login on console of one of my VMs.

[catborise]

It is fixed . If someone is not owner of instance and not a superuser, cannot access Console even if he has uuid and host number