starred/netbox
1
0
Fork 0
mirror of https://github.com/netbox-community/netbox.git synced 2026-01-12 05:20:31 +01:00
Code Issues 273 Packages Projects Releases 10 Wiki Activity

Cannot Remove Authentication > Tokens access with permissions #8541

New Issue
Closed
opened 2025-12-29 20:37:56 +01:00 by adam · 4 comments
adam commented 2025-12-29 20:37:56 +01:00
Owner
Copy Link

Originally created by @Pythbit on GitHub (Aug 30, 2023).

Originally assigned to: @jeremystretch on GitHub.

NetBox version

v3.6.0

Python version

3.10

Steps to Reproduce

  1. Create user with very limited access permissions (e.g view DCIM > Circuits)
  2. Login with user
  3. Admin > Authentication > API Tokens still visible

Expected Behavior

API Tokens and Admin tabs should be hidden without permissions to view them.

Observed Behavior

Option is visible in navigation bar

I notice the affected page is /user/tokens/ as opposed to /user/api-tokens and I'm not sure if one is a replacement for the other or what the plans may be here.

Originally created by @Pythbit on GitHub (Aug 30, 2023). Originally assigned to: @jeremystretch on GitHub. ### NetBox version v3.6.0 ### Python version 3.10 ### Steps to Reproduce 1. Create user with very limited access permissions (e.g view DCIM > Circuits) 2. Login with user 3. Admin > Authentication > API Tokens still visible ### Expected Behavior API Tokens and Admin tabs should be hidden without permissions to view them. ### Observed Behavior Option is visible in navigation bar I notice the affected page is /user/tokens/ as opposed to /user/api-tokens and I'm not sure if one is a replacement for the other or what the plans may be here.
adam added the type: bugstatus: acceptedseverity: low labels 2025-12-29 20:37:56 +01:00
adam closed this issue 2025-12-29 20:37:56 +01:00
adam commented 2025-12-29 20:37:57 +01:00
Author
Owner
Copy Link

@jeremystretch commented on GitHub (Aug 30, 2023):

Thank you for opening a bug report. Unfortunately, the information you have provided is not sufficient for someone else to attempt to reproduce the reported behavior. Remember, each bug report must include detailed steps that someone else can follow on a clean, empty NetBox installation to reproduce the exact problem you're experiencing. These instructions should include the creation of any involved objects, any configuration changes, and complete accounting of the actions being taken. Also be sure that your report does not reference data on the public NetBox demo, as that is subject to change at any time by an outside party and cannot be relied upon for bug reports.

@jeremystretch commented on GitHub (Aug 30, 2023): Thank you for opening a bug report. Unfortunately, the information you have provided is not sufficient for someone else to attempt to reproduce the reported behavior. Remember, each bug report must include detailed steps that someone else can follow on a clean, empty NetBox installation to reproduce the exact problem you're experiencing. These instructions should include the creation of any involved objects, any configuration changes, and complete accounting of the actions being taken. Also be sure that your report does not reference data on the public NetBox demo, as that is subject to change at any time by an outside party and cannot be relied upon for bug reports.
adam commented 2025-12-29 20:37:57 +01:00
Author
Owner
Copy Link

@Pythbit commented on GitHub (Aug 30, 2023):

re-opened and modified description. Was able to recreate on the demo as well.

@Pythbit commented on GitHub (Aug 30, 2023): re-opened and modified description. Was able to recreate on the demo as well.
adam commented 2025-12-29 20:37:57 +01:00
Author
Owner
Copy Link

@jeremystretch commented on GitHub (Aug 31, 2023):

This is happening because display of the menu option is controlled by the users.view_token permission, which is assigned to all users by default. (The permission is constrained such that each user can view only their own API tokens.)

While the view itself is practically identical to the individual account view at /user/api-tokens/ for users without any additional permissions, I agree that it doesn't make sense to make it available in the menu.

@jeremystretch commented on GitHub (Aug 31, 2023): This is happening because display of the menu option is controlled by the `users.view_token` permission, which is assigned to all users [by default](https://docs.netbox.dev/en/stable/configuration/security/#default_permissions). (The permission is constrained such that each user can view only their own API tokens.) While the view itself is practically identical to the individual account view at `/user/api-tokens/` for users without any additional permissions, I agree that it doesn't make sense to make it available in the menu.
adam commented 2025-12-29 20:37:58 +01:00
Author
Owner
Copy Link

@jeremystretch commented on GitHub (Aug 31, 2023):

Marking this as blocked by #13638 for now. Hoping to have that implemented very soon.

@jeremystretch commented on GitHub (Aug 31, 2023): Marking this as blocked by #13638 for now. Hoping to have that implemented very soon.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
beta
breaking change
complexity: high
complexity: low
complexity: medium
needs milestone
netbox
pending closure
plugin candidate
pull-request
Mirrored from GitHub Pull Request
 severity: high
severity: low
severity: medium
status: accepted
status: backlog
status: blocked
status: duplicate
status: needs owner
status: needs triage
status: revisions needed
status: under review
topic: GraphQL
topic: Internationalization
topic: OpenAPI
topic: UI/UX
topic: cabling
topic: event rules
topic: htmx navigation
topic: industrialization
topic: migrations
topic: plugins
topic: scripts
topic: templating
topic: testing
type: bug
type: deprecation
type: documentation
type: feature
type: housekeeping
type: translation
No Label severity: low status: accepted type: bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/netbox#8541
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?