{"action":"reopened","issue":{"url":"https://api.github.com/repos/hashicorp/vault/issues/723","repository_url":"https://api.github.com/repos/hashicorp/vault","labels_url":"https://api.github.com/repos/hashicorp/vault/issues/723/labels{/name}","comments_url":"https://api.github.com/repos/hashicorp/vault/issues/723/comments","events_url":"https://api.github.com/repos/hashicorp/vault/issues/723/events","html_url":"https://github.com/hashicorp/vault/issues/723","id":113738091,"number":723,"title":"allow user to control vault CLI choice to store auth token in ENV VAULT_TOKEN instead of $HOME/.vault-token","user":{"login":"careyblack","id":3325757,"avatar_url":"https://avatars.githubusercontent.com/u/3325757?v=3","gravatar_id":"","url":"https://api.github.com/users/careyblack","html_url":"https://github.com/careyblack","followers_url":"https://api.github.com/users/careyblack/followers","following_url":"https://api.github.com/users/careyblack/following{/other_user}","gists_url":"https://api.github.com/users/careyblack/gists{/gist_id}","starred_url":"https://api.github.com/users/careyblack/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/careyblack/subscriptions","organizations_url":"https://api.github.com/users/careyblack/orgs","repos_url":"https://api.github.com/users/careyblack/repos","events_url":"https://api.github.com/users/careyblack/events{/privacy}","received_events_url":"https://api.github.com/users/careyblack/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/hashicorp/vault/labels/enhancement","name":"enhancement","color":"d4c5f9"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-10-28T03:46:32Z","updated_at":"2016-04-19T22:36:43Z","closed_at":null,"body":"I was surprised that a second ssh session (as an already authenticated user to vault) would inherit the existing \"vault token\".\n\nIt looks like the default way that the CLI stores a users session is through the $HOME/.vault-token file. (Which is easily read from other new, or existing, ssh sessions.)\n\nI think the existing behavior could be desired by some. However, I can also see a desire for it to use the environment variable VAULT_TOKEN  and not the file cache to avoid the described behavior.\n\nMaybe add another value to the server config file (I assume it is also used by the CLI (but maybe it would need to use a user local config file $HOME/.vault ??) with a setting like:   token_storage=[user_file | environment_variable ]  So that the host/user can choose how they what the command line to operate for them.\n\n\nNOTE\" As a temp workaround a user can can do this after they authenticate in any session.... ( However, it seems fairly trivial to avoid if the user could control how the CLI works by default.)\n\n```bash\nexport VAULT_TOKEN=`cat $HOME/.vault-token`;rm $HOME/.vault-token\n```"}}