Overview
Plugins in WebStray Authenticator run with the same privileges as the core application. This includes access to Node.js APIs and the application's database. Enabling a plugin is a trust-based decision made by the user, and as a developer, you are responsible for maintaining the integrity of the vault.
Handling Decrypted Data
The sdk.crypto.decrypt function provides access to plaintext secrets. To ensure user safety, follow these rules:
- Memory Management: Keep decrypted values in memory only for the duration of the required action. Clear all references immediately after use.
- No Logging: Never log decrypted secrets, passwords, or TOTP seeds to the console or any external logging service.
- No Persistence: Never save plaintext data to the filesystem or the database. All sensitive data must remain encrypted at rest.
Database Access
The sdk.db object provides direct access to the NeDB instance.
- Precise Queries: Always use specific queries to target only the data your plugin requires. Avoid broad searches that dump metadata.
- Write Safety: Remember that mistakes in
updateorremoveoperations affect the user's actual vault. Always validate your data before performing write operations.
Network and System I/O
The SDK does not restrict access to fetch or Node.js filesystem modules. However, this power comes with specific responsibilities:
- Use TLS: All network communication must be performed over HTTPS.
- Transparency: Clearly document any network activity in your plugin's description. Users should know if a plugin connects to an external service.
- Validation: Treat all data received from the network as untrusted. Sanitize and validate any external input before using it in your UI or logic.
UI & UX Boundaries
To prevent phishing and maintain a consistent user experience, adhere to these UI boundaries:
- Authentication: Never prompt the user for their Master Password. All authentication and verification prompts are managed exclusively by the core application.
- Honesty: Use truthful titles and descriptions in your
package.json. Do not attempt to mimic core system messages or system-level alerts.
Summary
WebStray Authenticator provides a powerful execution environment for plugins. By following these security guidelines, you ensure that your plugin provides value without compromising the confidentiality and stability of the user's vault.