tailshare: do not persist Tailscale auth keys by default #190

New Issue

2026-08-14T19:13:29+02:00

codinget commented

2026-08-14 19:13:29 +02:00

Problem

Tailshare includes authKey in TailshareConfig and serializes that whole object under tailshare:config in localStorage. A Tailscale auth key is an enrollment credential. Persisting it with ordinary preferences makes it available to every same-origin script and retains it after the registration flow no longer needs it.

Persistent node identity is a separate feature: retaining node state must not imply retaining the credential that originally enrolled the node.

Direction

separate credential state from persisted Tailshare preferences;
keep auth keys in memory or session scope by default;
discard the key after successful registration where the lifecycle permits it;
migrate existing tailshare:config values by removing any persisted authKey;
cover both main-thread and SharedWorker initialization without placing the raw key in observable configuration identities, errors, logs, or events;
preserve current diagnostic redaction;
if persistent credential storage remains possible, make it an explicit and conspicuous opt-in rather than the default.

Acceptance

normal preference persistence and reload contain no auth key;
legacy persisted keys are removed safely without losing unrelated settings;
main-thread and SharedWorker registration still work;
initialization failure and fallback do not re-persist or expose the key;
logout/reset and successful registration clear credential state as documented;
tests cover migration, reload, success, failure, fallback, redaction, and reset.

## Problem Tailshare includes `authKey` in `TailshareConfig` and serializes that whole object under `tailshare:config` in `localStorage`. A Tailscale auth key is an enrollment credential. Persisting it with ordinary preferences makes it available to every same-origin script and retains it after the registration flow no longer needs it. Persistent node identity is a separate feature: retaining node state must not imply retaining the credential that originally enrolled the node. ## Direction - separate credential state from persisted Tailshare preferences; - keep auth keys in memory or session scope by default; - discard the key after successful registration where the lifecycle permits it; - migrate existing `tailshare:config` values by removing any persisted `authKey`; - cover both main-thread and SharedWorker initialization without placing the raw key in observable configuration identities, errors, logs, or events; - preserve current diagnostic redaction; - if persistent credential storage remains possible, make it an explicit and conspicuous opt-in rather than the default. ## Acceptance - normal preference persistence and reload contain no auth key; - legacy persisted keys are removed safely without losing unrelated settings; - main-thread and SharedWorker registration still work; - initialization failure and fallback do not re-persist or expose the key; - logout/reset and successful registration clear credential state as documented; - tests cover migration, reload, success, failure, fallback, redaction, and reset. ## Related - #91 owns persistent non-ephemeral node identity and must keep node state distinct from enrollment credentials; - #127, completed by PR #167, established secret-safe worker configuration identities; - #168 owns deliberate worker reconfiguration.

codinget added the

Agent

gpt-5.6-sol

Agentic Component/Tailshare

Security labels 2026-08-14 19:13:29 +02:00

codinget commented

2026-08-27 09:59:49 +02:00

migrate existing tailshare:config values by removing any persisted authKey;

The only existing one is mine as this is not published, I'll fix it manually

> migrate existing tailshare:config values by removing any persisted authKey; The only existing one is mine as this is not published, I'll fix it manually

codinget referenced this issue from a commit

2026-08-27 12:16:46 +02:00

feat(tsconnect-worker): let a keyless client attach to a registered IPN

codinget referenced this issue from a commit

2026-08-27 12:16:46 +02:00

fix(tailshare): keep Tailscale auth keys out of persisted preferences

codinget referenced a pull request that will close this issue

2026-08-27 12:17:03 +02:00

Keep Tailscale auth keys out of persisted preferences #237

codinget referenced this issue

2026-08-27 12:17:39 +02:00

tailshare: browser tests for Tailscale connection and credential lifecycle #238