@@ -5,41 +5,45 @@ author: Tobias Bieniek
5
5
team : the crates.io team <https://www.rust-lang.org/governance/teams/crates-io>
6
6
---
7
7
8
- If you created a new API token on crates.io lately, you may have noticed our new
9
- API token creation page and some of the new features it supports.
10
-
11
- Previously, when you clicked the "New Token" button on < https://crates.io/settings/tokens >
12
- you would only get the option to choose a name for the token, but nothing else.
13
- We knew that we wanted to offer our users more choices, but in the previous user
14
- interface that would have been difficult, so our first step was to build a
15
- proper "New API Token" page.
16
-
17
- Our next two features on the to-do list were both described as "token scopes".
18
- One part is allowing you to restrict API tokens to certain operations, e.g.
19
- only allowing a token to publish new versions of existing crates, but not any
20
- new crates. The second part is an optional restriction for the token to only
21
- work with certain crate names. If you want to read more about how these features
8
+ If you recently generated a new API token on crates.io lately, you might have
9
+ noticed our new API token creation page and some of the new features it now
10
+ supports.
11
+
12
+ Previously, when clicking the "New Token" button on < https://crates.io/settings/tokens > ,
13
+ you were only provided with the option to choose a token name, without any
14
+ additional choices. We knew that we wanted to offer our users more flexibility,
15
+ but in the previous user interface that would have been difficult, so our first
16
+ step was to build a proper "New API Token" page.
17
+
18
+ Our roadmap included two essential features known as "token scopes". The first
19
+ of them allows you to restrict API tokens to specific operations. For instance,
20
+ you can configure a token to solely enable the publishing of new versions for
21
+ existing crates, while disallowing the creation of new crates. The second one
22
+ offers an optional restriction where tokens can be limited to only work for
23
+ specific crate names. If you want to read more about how these features
22
24
were planned and implemented you can take a look at our corresponding
23
25
[ tracking issue] ( https://github.com/rust-lang/crates.io/issues/5443 ) .
24
26
25
- The remaining piece to making crates.io API tokens more secure was implementing
26
- expiration dates for them . Since we had already touched most of the
27
- token-related code this was relatively straight-forward, and we are happy to
27
+ To further enhance the security of crates.io API tokens, we prioritized the
28
+ implementation of expiration dates . Since we had already touched most of the
29
+ token-related code this was relatively straight-forward. We are delighted to
28
30
announce that our "New API Token" page now supports endpoint scopes, crate
29
31
scopes and expiration dates:
30
32
31
33
![ Screenshot of the "New API Token" page] ( /images/2023-06-23-improved-api-tokens-for-crates-io/new-api-token-page.png )
32
34
33
- Similar to when you create an API token on github.com, you can choose to not
34
- have an expiration date, use one of the presets, or even choose a custom
35
- expiration date.
35
+ Similar to the API token creation process on github.com, you can choose to not
36
+ have any expiration date, use one of the presets, or even choose a custom
37
+ expiration date to suit your requirements .
36
38
37
- If you notice any issues, or if you have any questions don't hesitate to find us
38
- on [ Zulip] ( https://rust-lang.zulipchat.com/#narrow/stream/318791-t-crates-io/topic/token.20scopes )
39
+ If you come across any issues or have questions, feel free to reach out to us on
40
+ [ Zulip] ( https://rust-lang.zulipchat.com/#narrow/stream/318791-t-crates-io/topic/token.20scopes )
39
41
or open an issue on [ GitHub] ( https://github.com/rust-lang/crates.io/issues/new/choose ) .
40
42
41
- Finally, the crates.io team would like to thank the [ OpenSSF's Alpha-Omega Initiative] ( https://openssf.org/community/alpha-omega/ )
43
+ Lastly, we, the crates.io team, would like to express our gratitude to the
44
+ [ OpenSSF's Alpha-Omega Initiative] ( https://openssf.org/community/alpha-omega/ )
42
45
and [ JFrog] ( https://jfrog.com/blog/jfrog-joins-rust-foundation-as-platinum-member/ )
43
- for funding the [ Rust Foundation] ( https://rustfoundation.org ) security
44
- initiative, which enabled us to implement these features and perform a lot of
45
- other security-related work on the crates.io codebase in the past couple of months!
46
+ for their contributions to the [ Rust Foundation] ( https://rustfoundation.org )
47
+ security initiative. Their support has been instrumental in enabling us to
48
+ implement these features and undertake extensive security-related work on the
49
+ crates.io codebase over the past few months.
0 commit comments