maxmustermann/gitlab
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

Add & update security considerations for PATs

Browse source
This commit is contained in:
Nick Malcolm 2021-11-09 02:20:19 +00:00 committed by Evan Read
parent 1c1a006d8d
commit a536dd2796
2 changed files with 9 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
doc/security/token_overview.md
View file

@ -117,4 +117,9 @@ Instead, API calls can be passed an access token using headers, like [the `Priva
Tokens can also be stored using a [Git credential storage](https://git-scm.com/book/en/v2/Git-Tools-Credential-Storage).
Tokens should not be committed to your source code. Instead, consider an approach such as [using external secrets in CI](../ci/secrets/index.md).
When creating a scoped token, consider using the most limited scope possible to reduce the impact of accidentally leaking the token.
When creating a token, consider setting a token that expires when your task is complete. For example, if performing a one-off import, set the
token to expire after a few hours or a day. This reduces the impact of a token that is accidentally leaked because it is useless when it expires.

4
doc/user/profile/personal_access_tokens.md
View file

@ -62,6 +62,10 @@ to the URL. For example:
https://gitlab.example.com/-/profile/personal_access_tokens?name=Example+Access+token&scopes=api,read_user,read_registry
```
WARNING:
Personal access tokens must be treated carefully. Read our [token security considerations](../../security/token_overview.md#security-considerations)
for guidance on managing personal access tokens (for example, setting a short expiry and using minimal scopes).
## Revoke a personal access token
At any time, you can revoke a personal access token.