On 7/20/12 10:00 AM, "Nitin Mehta" <[email protected]> wrote:
>Good point. I think it hasn't been issue so far since it's an admin only >call but its better to make this POST. But, I am not sure about other >commands like addVPNUser which are authorized for all the accounts. Are >they also GET? > >-----Original Message----- >From: Koushik Das [mailto:[email protected]] >Sent: Friday, July 20, 2012 2:36 AM >To: [email protected] >Subject: MS UI - addHost call is a GET and the password of the host goes >as cleartext > >The request URL may get logged in Tomcat and that may lead to security >issues. Any call having such data should be a POST. > >Thanks, >Koushik > It shouldnt' matter who is executing the command; this kind of information should never be logged. I know that in the management server log file we hide sensitive information like passwords, sshKeys, etc. When commands are being logged in api.log, we have to follow the same logic. -Alena.
