Token prefixes: Support for workspace tokens
What does this MR do and why?
This MR adds support for workspace tokens to instance wide token prefixes.
Workspace tokens will now include the instance wide token prefix when configured. The new token format is <instance>-glwt-token.
This feature is still behind the feature flag custom_prefix_for_all_token_types.
With this custom prefix, it is easier to identify leaked tokens, because we can now skip all leaked tokens that start with gl.
Now, we only need to look at tokens starting with mycompanyname-.
References
- Allow custom instance token prefix for all toke... (#388379)
- https://docs.gitlab.com/security/tokens/#workspace-token
How to set up and validate locally
- Enable feature flag via
rails c:
Feature.enable(:custom_prefix_for_all_token_types)
- Change the instance wide token prefix:
Admin area > General > Account and limit > Instance token prefix, e.g. tomycustomprefix - Creating a new workspace should succeed. Old workspaces should continue to work.
MR acceptance checklist
checklist
- Changelog entry added, if necessary
- Documentation created/updated via this MR
- Documentation reviewed by technical writer or follow-up review issue created
- Tests added for this feature/bug
- Tested in all supported browsers
- Conforms to the code review guidelines
- Conforms to the merge request performance guidelines
- Conforms to the style guides
- Conforms to the javascript style guides
- Conforms to the database guides
Related to #388379
Edited by Nicholas Wittstruck