Open Stack

Alexandra Shulman-Peleg <SHULMANA at il.ibm.com> writes:

> It seems that keeping the keys un-encrypted as part of the account
> info is a security vulnerability which allows anyone who can read the
> account meta data to generate and fake temp urls. Shouldn't we protect

The account meta data is only available to the user owner of the account
(i.e: the one with the role admin or swiftoperator from the
operator_roles settings for keystoneauth) not to anyone else.

There is no account ACL on Swift ATM which would allow someone else to
have access to those headers.

Chmouel.