Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

doc: update documentation to point to security best practice #14942

Open
wants to merge 4 commits into
base: main
Choose a base branch
from
Open

doc: update documentation to point to security best practice #14942

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
1f744e9
doc: update documentation to point to security best practice
cuiy0006 Jan 16, 2025
8738585
relocate
cuiy0006 Jan 16, 2025
5fd9ab0
add more comments
cuiy0006 Jan 16, 2025
b9cc1e3
replace with @warning
cuiy0006 Jan 16, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 16 additions & 0 deletions google/cloud/credentials.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -119,6 +119,14 @@ std::shared_ptr<Credentials> MakeInsecureCredentials(Options opts = {});
* service account key file, or a JSON object describing your user
* credentials.
*
* @warning If you accept a credential configuration (credential
* JSON/File/Stream) from an external source for authentication to Google Cloud
* Platform, you must validate it before providing it to any Google API or
* client library. Providing an unvalidated credential configuration to Google
* APIs can compromise the security of your systems and data. For more
* information, refer to
* https://cloud.google.com/docs/authentication/external/externally-sourced-credentials.
*
* @see https://cloud.google.com/docs/authentication for more information on
* authentication in GCP.
*
Expand Down Expand Up @@ -265,6 +273,14 @@ std::shared_ptr<Credentials> MakeServiceAccountCredentials(
* identity provider that supports OpenID Connect (OIDC), such as Microsoft
* Azure, or SAML 2.0.
*
* @warning If you accept a credential configuration (credential
* JSON/File/Stream) from an external source for authentication to Google Cloud
* Platform, you must validate it before providing it to any Google API or
* client library. Providing an unvalidated credential configuration to Google
* APIs can compromise the security of your systems and data. For more
* information, refer to
* https://cloud.google.com/docs/authentication/external/externally-sourced-credentials.
*
* @see https://cloud.google.com/docs/authentication for more information on
* authentication in GCP.
*
Expand Down
7 changes: 7 additions & 0 deletions google/cloud/doc/guac.dox
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -89,12 +89,19 @@ considered implementation details. If you would like to use them in your
own libraries please file a [feature request]. We cannot promise that we will
be able to satisfy these requests, but we will give them full consideration.

**Important**: If you accept a credential configuration (credential JSON/File/Stream)
from an external source for authentication to Google Cloud Platform, you must
validate it before providing it to any Google API or client library. Providing
an unvalidated credential configuration to Google APIs can compromise the security
of your systems and data. For more information, refer to [externally sourced credentials].

[principal-overview]: https://cloud.google.com/iam/docs/overview#how_cloud_iam_works
[Authentication at Google]: https://cloud.google.com/docs/authentication
[IAM overview]: https://cloud.google.com/iam/docs/overview
[Application Default Credentials]: https://cloud.google.com/docs/authentication/application-default-credentials
[Oauth2]: https://oauth.net/2/
[service account keyfile]: https://cloud.google.com/iam/docs/creating-managing-service-account-keys
[feature request]: https://github.com/googleapis/google-cloud-cpp/issues
[externally sourced credentials]: (https://cloud.google.com/docs/authentication/external/externally-sourced-credentials)

*/
Loading