AD – A Javascript implementation of common Active Directory tasks

Re:AD – A Javascript implementation of common Active Directo... by ToFab123 on Thursday August 03, 2017 @02:19AM (#14917352)

Let me get this straight. Passwords, including the password of a domain admin, are hardcoded as plain text in client side JavaScript files. Surely, I must be reading this wrong?

[ Parent | on HN ]

Re:AD – A Javascript implementation of common Active Directo... by robinj6 on Thursday August 03, 2017 @02:28AM (#14917387)

Reading it wrong. Any application needs to use secrets, it's up to the developer to pass them in properly. For example, you can use environmental variables, command line args when running the process, or a config file. This isn't a client-side library.

[ Parent | on HN ]

Re:AD – A Javascript implementation of common Active Directo... by _ar7 on Thursday August 03, 2017 @02:28AM (#14917386)

Yeah you're reading it wrong. This is for node so it'd never be client side, and I'm sure the pw examples are in plaintext just for simplicity in the README.

[ Parent | on HN ]

Re:AD – A Javascript implementation of common Active Directo... by IncRnd on Thursday August 03, 2017 @09:03AM (#14919143)

The authors are even aware of this! The admin password in their first example is "howinsecure".

[ Parent | on HN ]

Re:AD – A Javascript implementation of common Active Directo... by tracker1 on Thursday August 03, 2017 @04:44PM (#14923698)

A recent shared secret, I defaulted to "not very secure" for local dev/testing, but uses an environment variable in practice.

[ Parent | on HN ]

Re:AD – A Javascript implementation of common Active Directo... by IncRnd on Thursday August 03, 2017 @07:40PM (#14925054)

Thank you for the clarification.

[ Parent | on HN ]