Protection of user credentials during code execution
Techniques are presented for managing access to external resources while executing code. The method involves receiving a request to execute code and sending an identifier (ID) for the code execution and credentials for accessing an external resource to a trusted server. The request is sent to execute the code with the ID to a code executer, and the code is executed. During code execution, an operation for accessing the external resource is detected. In response to the detection, a request to access the external resource is sent from the code executer to the trusted server. The trusted server accesses the external resource using the provided credentials and sends a response with the results back to the code executer. The code executer does not have access to the credentials for accessing the external resource. After the code terminates execution, the results from the code execution are presented on a device.
1. A computer-implemented method comprising:
receiving, by a controller, a request to execute code;
sending, by the controller to a trusted server, an identifier (ID) associated with the execution of the code and credentials for accessing an external resource;
sending, by the controller to a code executer, the request to execute the code with the ID;
executing the code by the code executer;
while executing the code, perform operations comprising:
detecting an operation for accessing the external resource;
in response to the detecting, sending, from the code executer to the trusted server, a request to access the external resource;
accessing, by the trusted server, the external resource using the credentials; and
sending a response, from the trusted server to the code executer, with results from accessing the external resource, wherein the code executer does not have access to the credentials for accessing the external resource; and
after the code terminates execution, causing presentation on a device of results from the execution of the code.
2. The method as recited in claim 1 , further comprising:
in response to receiving the request to execute code, generating a sandbox identifier associated with the request; and
utilizing the sandbox identifier while executing the code by the controller, the trusted server, and the code executer.
3. The method as recited in claim 1 , further comprising:
in response to receiving the request to execute code, presenting a request for the credentials on a device of a user; and
obtaining a token associated with the credentials, the token being used to authenticate a user to obtain access to the external resource.
4. The method as recited in claim 1 , further comprising:
after execution of the code, saving the code on a task marketplace as a first task without saving the credentials, wherein other users may execute the code of the first task using different credentials.
5. The method as recited in claim 4 , further comprising:
detecting another request from a different user to execute the first task;
obtaining credentials for the different user; and
executing the code for the first task utilizing the credentials of the different user.
6. The method as recited in claim 4 , further comprising:
combining the first task with a second task created by a second user to create a third task, wherein the third task includes the code from the first task, the code from the second task, and a set of credentials required to execute the third task, the set of credentials required including the credentials required for the first task and the credentials required for the second task.
7. The method as recited in claim 1 , further comprising:
sending status updates, from the code executer to the controller, during the execution of the code for presentation on a computer device.
8. The method as recited in claim 1 , wherein the external resource is a file and the request to access the external resource is to read from the file, wherein the credentials correspond to the credentials of a user for accessing a file system where the file is stored.
9. The method as recited in claim 1 , wherein the controller manages a database of identifiers associated with code being executed in respective sandboxes.
10. The method as recited in claim 1 , wherein the trusted server manages a database of encrypted tokens associated with credentials of users.
11. A system comprising:
a memory comprising instructions; and
one or more computer processors, wherein the instructions, when executed by the one or more computer processors, cause the system to perform operations comprising:
receiving, by a controller, a request to execute code;
sending, by the controller to a trusted server, an identifier (ID) associated with the execution of the code and credentials for accessing an external resource;
sending, by the controller to a code executer, the request to execute the code with the ID;
executing the code by the code executer;
while executing the code, perform operations comprising:
detecting an operation for accessing the external resource;
in response to the detecting, sending, from the code executer to the trusted server, a request to access the external resource;
accessing, by the trusted server, the external resource using the credentials; and
sending a response, from the trusted server to the code executer, with results from accessing the external resource, wherein the code executer does not have access to the credentials for accessing the external resource; and
after the code terminates execution, causing presentation on a device of results from the execution of the code.
12. The system as recited in claim 11 , wherein the instructions further cause the one or more computer processors to perform operations comprising:
in response to receiving the request to execute code, generating a sandbox identifier associated with the request; and
utilizing the sandbox identifier while executing the code by the controller, the trusted server, and the code executer.
13. The system as recited in claim 11 , wherein the instructions further cause the one or more computer processors to perform operations comprising:
in response to receiving the request to execute code, presenting a request for the credentials on a device of a user; and
obtaining a token associated with the credentials, the token being used to authenticate a user to obtain access to the external resource.
14. The system as recited in claim 11 , wherein the instructions further cause the one or more computer processors to perform operations comprising:
after execution of the code, saving the code on a task marketplace as a first task without saving the credentials, wherein other users may execute the code of the first task using different credentials.
15. The system as recited in claim 14 , wherein the instructions further cause the one or more computer processors to perform operations comprising:
detecting another request from a different user to execute the first task;
obtaining credentials for the different user; and
executing the code for the first task utilizing the credentials of the different user.
16. A non-transitory machine-readable storage medium including instructions that, when executed by a machine, cause the machine to perform operations comprising:
receiving, by a controller, a request to execute code;
sending, by the controller to a trusted server, an identifier (ID) associated with the execution of the code and credentials for accessing an external resource;
sending, by the controller to a code executer, the request to execute the code with the ID;
executing the code by the code executer;
while executing the code, perform operations comprising:
detecting an operation for accessing the external resource;
in response to the detecting, sending, from the code executer to the trusted server, a request to access the external resource;
accessing, by the trusted server, the external resource using the credentials; and
sending a response, from the trusted server to the code executer, with results from accessing the external resource, wherein the code executer does not have access to the credentials for accessing the external resource; and
after the code terminates execution, causing presentation on a device of results from the execution of the code.
17. The non-transitory machine-readable storage medium as recited in claim 16 , wherein the machine further performs operations comprising:
in response to receiving the request to execute code, generating a sandbox identifier associated with the request; and
utilizing the sandbox identifier while executing the code by the controller, the trusted server, and the code executer.
18. The non-transitory machine-readable storage medium as recited in claim 16 , wherein the machine further performs operations comprising:
in response to receiving the request to execute code, presenting a request for the credentials on a device of a user; and
obtaining a token associated with the credentials, the token being used to authenticate a user to obtain access to the external resource.
19. The non-transitory machine-readable storage medium as recited in claim 16 , wherein the machine further performs operations comprising:
after execution of the code, saving the code on a task marketplace as a first task without saving the credentials, wherein other users may execute the code of the first task using different credentials.
20. The non-transitory machine-readable storage medium as recited in claim 19 , wherein the machine further performs operations comprising:
detecting another request from a different user to execute the first task;
obtaining credentials for the different user; and
executing the code for the first task utilizing the credentials of the different user.