search

ScalaConsultants / rapid-development

0 stars 1 forks source link

Rethink how much data should be returned by `/healthcheck` #4

Open note opened 7 years ago

note commented 7 years ago

As for now, it's a possible result of /healthcheck:

{
  "success" : false,
  "message" : "Unhealthy",
  "environment" : "not specified",
  "hostName" : "Michas-MacBook-Pro.local",
  "buildTimestamp" : "2017-06-30T11:36:24+0200",
  "gitBranch" : "master",
  "gitCommit" : "add49d2638fa131462d04b26a4397b77ea1ed419",
  "project" : "",
  "build" : "-1",
  "instigator" : "",
  "externalComponents" : [ {
    "success" : false,
    "responseTime" : 67,
    "component" : "Database",
    "details" : { },
    "error" : "Failed to initialize pool: Connection to localhost:5432 refused. Check that the hostname and port are correct and that the postmaster is accepting TCP/IP connections."
  } ]
}

It contains some significant data that may affect security. Those are hostName and port to PostgreSQL, other data may be debatable too. Also, I think gitBranch is unneccessary - gitCommit by itself is enough to identify code version with full precision.

I think the basic question we need to answer here is: is rapid-development app meant to be visible on outside or rather it should be just a microservice visible in some internal network? If the latter one then maybe we should go in the opposite direction and actually expose even more data that may be useful for debugging.

It's not an urgent task but I feel should be discussed at some point.

leszekgruchala commented 7 years ago

This endpoint is not meant to be publicly available. All these information are helpful especially when you have microservices, qa, stage environments and you want to know what is where.