Enhance security recommendations for trusted publishers (#1703)
Improve OIDC docs recommending disallowing non-OIDC tokens. ## References Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Co-authored-by: Peter Stöckli <p-@github.com>
Leo Balter committed
Sep 15, 2025 at 09:02 UTC
ae95f5514ee450b1c4228b7811bd614aa40e8070
1 file changed
+26
content/packages-and-modules/securing-your-code/trusted-publishers.mdx
+26
@@ -147,6 +147,32 @@ The `id_tokens` configuration tells GitLab to generate an OIDC token for npm. Le
147
148
You can modify or remove your trusted publisher configuration at any time through your package settings on [npmjs.com](https://npmjs.com). Each package can only have one trusted publisher connection at a time, but this connection can be edited or deleted as needed. To change providers (for example, switching from GitHub Actions to GitLab CI/CD), simply edit your existing configuration and select the new provider. The change takes effect immediately for future publishes. To remove trusted publishing entirely and return to token-based authentication, delete the trusted publisher configuration from your package settings.
149
150
+## Recommended: Restrict token access when using trusted publishers
151
+
152
+Once you've configured trusted publishers for your package, we strongly recommend restricting traditional token-based publishing access for enhanced security.
153
+
154
+### How to configure maximum security
155
+
156
+1. After enabling trusted publishers, navigate to your package's **Settings** → **Publishing access**
157
+2. Select **"Require two-factor authentication and disallow tokens"**
158
+3. Save your changes by clicking on **Update Package Settings**
159
+
160
+### Why this matters
161
+
162
+Trusted publishers use short-lived, scoped credentials that are generated on-demand during your CI/CD workflow, eliminating the need for long-lived tokens. By restricting traditional token access while using trusted publishers, you reduce potential security risks associated with credential management.
163
+
164
+**Note:** The "disallow tokens" setting only affects traditional token authentication. Your trusted publishers will continue to work normally, as they use OIDC tokens.
165
+
166
+### Migration tip
167
+
168
+If you're transitioning from token-based publishing:
169
+
170
+1. Set up trusted publishers first and verify they work
171
+2. Then restrict token access as described above
172
+3. [Revoke any existing automation tokens](https://docs.npmjs.com/revoking-access-tokens) that are no longer needed
173
+
174
+This ensures a smooth transition without disrupting your release process.
175
+
176
## Automatic provenance generation
177
178
When you publish using trusted publishing, npm automatically generates and publishes [provenance attestations](./generating-provenance-statements) for your package. This happens by default—you don't need to add the `--provenance` flag to your publish command.