{"action":"created","issue":{"url":"https://api.github.com/repos/Esri/resource-proxy/issues/492","repository_url":"https://api.github.com/repos/Esri/resource-proxy","labels_url":"https://api.github.com/repos/Esri/resource-proxy/issues/492/labels{/name}","comments_url":"https://api.github.com/repos/Esri/resource-proxy/issues/492/comments","events_url":"https://api.github.com/repos/Esri/resource-proxy/issues/492/events","html_url":"https://github.com/Esri/resource-proxy/issues/492","id":335988433,"node_id":"MDU6SXNzdWUzMzU5ODg0MzM=","number":492,"title":"A security issue when troubleshooting ArcGIS JavaScript API and Web AppBuilder applications with the Esri Resource Proxy.","user":{"login":"kGhime","id":34726142,"node_id":"MDQ6VXNlcjM0NzI2MTQy","avatar_url":"https://avatars0.githubusercontent.com/u/34726142?v=4","gravatar_id":"","url":"https://api.github.com/users/kGhime","html_url":"https://github.com/kGhime","followers_url":"https://api.github.com/users/kGhime/followers","following_url":"https://api.github.com/users/kGhime/following{/other_user}","gists_url":"https://api.github.com/users/kGhime/gists{/gist_id}","starred_url":"https://api.github.com/users/kGhime/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kGhime/subscriptions","organizations_url":"https://api.github.com/users/kGhime/orgs","repos_url":"https://api.github.com/users/kGhime/repos","events_url":"https://api.github.com/users/kGhime/events{/privacy}","received_events_url":"https://api.github.com/users/kGhime/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-06-26T20:59:29Z","updated_at":"2018-06-26T21:28:50Z","closed_at":null,"author_association":"NONE","body":"The proxy is accessing secured material (services or web maps) even when credentials are not supplied.\r\n\r\nThe workflow is the following:\r\n1. Create a JS API application that consumes a secure service or Webmap.\r\n2. Set proxy rules in the application.\r\n3. Add the server URL with the UN/pass or ClientId/ClientSecret to access these secure services into the proxy.config file.\r\n4. Run the app (token is generated with this UN/pass ClientId/ClientSecret) and you can see the secure data.\r\n5. Edit the proxy.config file and remove the UN/pass or ClientId/ClientSecret properties just added in step 3.\r\n6. Refresh the application in the browser and the application does not ask for credentials and displays the secure data.\r\n\r\nThis has been tested on many different browsers and different machines within the network. I believe that the token generated is stored in the server for 24 hours or so until it expires but I am not sure where or if this is actually what is occurring.\r\n\r\nAnyone can access this application on the network without the UN/pass or ClientId/ClientSecret in the proxy.config file for about 24 hours.\r\n\r\nI want to know how to overcome this issue or if this is a bug or an expected behavior?\r\nWhat should be the resolution?\r\n"},"comment":{"url":"https://api.github.com/repos/Esri/resource-proxy/issues/comments/400468600","html_url":"https://github.com/Esri/resource-proxy/issues/492#issuecomment-400468600","issue_url":"https://api.github.com/repos/Esri/resource-proxy/issues/492","id":400468600,"node_id":"MDEyOklzc3VlQ29tbWVudDQwMDQ2ODYwMA==","user":{"login":"esoekianto","id":5265339,"node_id":"MDQ6VXNlcjUyNjUzMzk=","avatar_url":"https://avatars0.githubusercontent.com/u/5265339?v=4","gravatar_id":"","url":"https://api.github.com/users/esoekianto","html_url":"https://github.com/esoekianto","followers_url":"https://api.github.com/users/esoekianto/followers","following_url":"https://api.github.com/users/esoekianto/following{/other_user}","gists_url":"https://api.github.com/users/esoekianto/gists{/gist_id}","starred_url":"https://api.github.com/users/esoekianto/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/esoekianto/subscriptions","organizations_url":"https://api.github.com/users/esoekianto/orgs","repos_url":"https://api.github.com/users/esoekianto/repos","events_url":"https://api.github.com/users/esoekianto/events{/privacy}","received_events_url":"https://api.github.com/users/esoekianto/received_events","type":"User","site_admin":false},"created_at":"2018-06-26T21:28:50Z","updated_at":"2018-06-26T21:28:50Z","author_association":"MEMBER","body":"@kGhime I assume this is .NET version of the resource-proxy? \r\n\r\nIf yes, then you can try changing the `recycling` interval of the `Application Pool` being used by resource proxy application in IIS. Try changing it to smaller number like 59 minutes. \r\n\r\nhttps://docs.microsoft.com/en-us/iis/configuration/system.applicationhost/applicationpools/add/recycling/ \r\n\r\nLet me know if this works."}}
{"actor":{"display_login":"esoekianto"}}