Question about basic authentication credentials leaking in URL via run_request

[gregolsen]

This is more of a question at this point.

As part of fixing a credentials leak in Open Telemetry Ruby instrumentation we noticed that run_request doesn't remove credentials from the URL as, for example, this code does https://github.com/lostisland/faraday/blob/main/lib/faraday/connection.rb#L366
Is that a desired behavior or would it be better to remove basic authentication credentials from the URL in run_request too?

[iMacTia]

Hi @gregolsen, I took the freedom of converting your issue into a discussion 👍!

The short answer is that run_request is a very low-level method and so I'd be reluctant in adding complex logic to it, especially if this is already managed in other layers. The method is supposed to be quite dumb and just execute the request.

Applications have different ways of providing basic authentication, but the recommended one is described on this documentation page (depending on the faraday version you're using).

If you follow that doc, your basic auth should use the Authorization header instead, which is I believe your objective here.

Appreciate this is probably not what you were hoping for, but in this case, it should be up to the elastic gem to properly set up basic authentication instead of passing it as part of the URL to a low-level method