New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Password is put in URL instead of header or basic auth #65

Open

hkrutzer opened this issue Mar 14, 2023 · 1 comment

Contributor

hkrutzer commented Mar 14, 2023 •

edited

Loading

Pillar puts the Clickhouse password in the URL when connecting. This means it can end up in log files and is more easily leaked.

https://clickhouse.com/docs/en/interfaces/http/#default-database says:

The username and password can be indicated in one of three ways:
[..]
2. In the ‘user’ and ‘password’ URL parameters (We do not recommend using this method as the parameter might be logged by web proxy and cached in the browser).

The documentation recommends using either a HTTP header, or HTTP basic auth.

sofakingworld added a commit that referenced this issue


#65 do Auth with headers, instead of query params

791d5b4

Member

sofakingworld commented Mar 15, 2023

Agree, I did fix. #67

Could you check it in your cases?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment