Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Logs show plaintext password #1796

Open
kinueng opened this issue Aug 15, 2023 · 1 comment · May be fixed by #1797
Open

Logs show plaintext password #1796

kinueng opened this issue Aug 15, 2023 · 1 comment · May be fixed by #1797

Comments

@kinueng
Copy link

kinueng commented Aug 15, 2023

When setting DEBUG=ioredis:* on a NodeJS server that has ioredis@5.3.2 installed, the ioredis logs show the password in plaintext.

This is different from existing issue Errors contain credentials in plaintext #1713 because no error logging is involved in this scenario. This scenario is just turning on all logs for a working Redis client.

2023-08-15T13:56:34.671Z ioredis:cluster:subscriber started
2023-08-15T13:56:34.677Z ioredis:redis status[***.***.***.***:PORT (ioredis-cluster(refresher))]: connecting -> connect
2023-08-15T13:56:34.677Z ioredis:redis write command[***.***.***.***:PORT (ioredis-cluster(refresher))]: 0 -> auth([ 'PLAINTEXT_PASSWORD_HERE' ])
2023-08-15T13:56:34.678Z ioredis:redis status[***.***.***.***:PORT (ioredis-cluster(refresher))]: connect -> ready
2023-08-15T13:56:34.678Z ioredis:connection set the connection name [ioredis-cluster(refresher)]

The Redis plaintext password should not be showing in ioredis logs.
@kinueng kinueng linked a pull request Aug 15, 2023 that will close this issue
Open
@theanishtar
Copy link

Is it a good solution?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

fix: hide sensitive data from debug logs kinueng/ioredis
2 participants
@kinueng @theanishtar