User/pass is output to log file.

[JohnMcLear]

2024-02-25 11:56:33.595 DEBUG (MainThread) [custom_components.fusion_solar.config_flow] async_step_openapi: {'host': 'https://eu5.fusionsolar.huawei.com', 'username': 'exampleusername', 'password': 'examplepassword'}

For security reasons you don't want to output user/passwords to log files.

[tijsverkoyen]

This is only logged in debug mode. Also: the password is stored in clear text in Home Assistant, as there is no way to encrypt this (as far as I know)

[JohnMcLear]

I'm 80% sure HA has a method for ensuring passwords are omitted from plugin debug logs but maybe that's core only as I can't see it after 1 minute searching online.

Can we at least leave this open as lots of the time plugin devs will say "send me your log file" and by default HA will spit out every plugin within scopes logs and this will include user/pass for third party services IE Fusionsolar.

Is it worth not trying to catch the error output from the auth attempt/request? That way user/pass wont be logged..

A quick Google for references:

• https://community.home-assistant.io/t/possible-security-issue-fritzbox-component-is-passing-username-and-password-in-clear-in-the-logs/186462
• https://community.home-assistant.io/t/influxdb-password-logged-in-plain-text-on-error-in-config/46233
• https://github.com/home-assistant/core/issues/12998

[tijsverkoyen]

If I check the links, there is no solution to redact content from the logs. Feel free to create a PR that removes https://github.com/tijsverkoyen/HomeAssistant-FusionSolar/blob/master/custom_components/fusion_solar/config_flow.py#L79

I never ask people to share their credentials on Github itself, and I also remove credentials if I see them being posted here.

[tijsverkoyen]

I have removed the debug logging. See https://github.com/tijsverkoyen/HomeAssistant-FusionSolar/commit/cdc720db3cc008591f2fe303380b6f41b4b86f45. Will be included in the next release