Handle password field type for plugin configuration

[ochorocho]

It would be great to be able to store a password in a secure way in the plugins configuration.

Example:

password: {
      title: 'Password',
      type: 'password',
      required: true
},

This consists of 2 components:

• Add an ajv definition for type password
• Use bcrypt to store the encrpyted password

Related to /pull/623

[karaggeorge]

I think I'm missing something. Wouldn't the point of saving the password in the config be to use it at some point in the plugin runtime? How would we retrieve the password if we hash it with bcrypt before saving? We would have to save it as plaintext.

Does the service you are trying to build a plugin for support tokens? I think that would probably be the best way of going about it, rather than saving the user's password.

[ochorocho]

@karaggeorge seems like a token can be used: https://docs.nextcloud.com/server/13/developer_manual/api/OC/Authentication/Token/IToken.html

The service i try to integrate ist called "Nextcloud"

[karaggeorge]

@ochorocho I would suggest using that instead, as we can't really save a user's password other than plaintext

[sindresorhus]

Supporting a password field might be a bad idea as it gives the illusion of security, but in reality, the password is just stored in plain text on disk.

Instead, I think we should update the plugin guide about recommending using a token instead.

[skllcrn]

To me it sounds like we should force tokens for security reasons @sindresorhus, but I'm not sure how or if that would work. As @karaggeorge mentioned:

Does the service you are trying to build a plugin for support tokens?

I'll update the docs to encourage token usage and close this issue unless anyone has additions @ochorocho.

[sindresorhus]

To me it sounds like we should force tokens for security reasons @sindresorhus

I don't see how we would enforce that. Not providing a password type and documenting the recommendation is the most we can do, I think.

[karaggeorge]

Yeah, we can add a note that basically says the plugins' config is saved as a plaintext file, so saving passwords is not particularly safe, but at the end of the day the plugins are made by other users, so if a user wants to install one and enter their password that's up to them

[ochorocho]

@skllcrn ok, thanks. Now I'm using nextclouds login flow and its working how i wanted it to work :-)