search

thetatoken / theta-infrastructure-ledger-explorer

Explorer for the Theta Ledger
https://docs.thetatoken.org/
MIT License
57 stars 26 forks source link

MongoDB URI exposed in plain text on the logs #21

Closed giovannirco closed 3 years ago

giovannirco commented 3 years ago

When using MongoDB URI to authenticate, both the crawler and explorer-api exposes the full URI in the logs without masking the username and password. This can lead to security issues if the logs gets stored for long term periods or if a large number of people have access to them

They are also saved in plain text on the config file but that would require local access to the kubernetes pods in order to see the file, but the explorer-api also shows the whole config file on startup

Screen Shot 2021-05-12 at 23 24 19

I appreciate if we can hide these values from the logs

giovannirco commented 3 years ago

This has been fixed and pushed to master branch and this log line is now suppressed