Use headers instead of URL params for ClickHouse credentials

redash/query_runner/clickhouse.py

@@ -99,12 +99,15 @@ def _send_query(self, data, session_id=None, session_check=None):
         timeout = self.configuration.get("timeout", 30)
 
         params = {
-            "user": self.configuration.get("user", "default"),
-            "password": self.configuration.get("password", ""),
             "database": self.configuration["dbname"],
             "default_format": "JSON",
         }
 
+        headers = {
+            "x-clickhouse-user": self.configuration.get("user", "default"),
+            "x-clickhouse-key": self.configuration.get("password", ""),
+        }
+
         if session_id:
             params["session_id"] = session_id
             params["session_check"] = "1" if session_check else "0"
@@ -119,6 +122,7 @@ def _send_query(self, data, session_id=None, session_check=None):
                 timeout=timeout,
                 params=params,
                 verify=verify,
+                headers=headers,
             )
 
             if not r.ok:

tests/query_runner/test_clickhouse.py

@@ -104,12 +104,17 @@ def test_send_single_query(self, post_request):
         self.assertEqual(
             kwargs["params"],
             {
-                "user": "default",
-                "password": "",
                 "database": "system",
                 "default_format": "JSON",
             },
         )
+        self.assertEqual(
+            kwargs["headers"],
+            {
+                "x-clickhouse-user": "default",
+                "x-clickhouse-key": "",
+            },
+        )
         self.assertEqual(kwargs["timeout"], 60)
 
     @patch("requests.post")