imbajin commented on code in PR #3189: URL: https://github.com/apache/hugegraph/pull/3189#discussion_r3924059642
########## hugegraph-pd/hg-pd-dist/src/assembly/static/conf/application.yml: ########## @@ -44,6 +44,15 @@ server: # REST service port number port: 8620 +auth: + # Shared secret checked against the password of the Basic credential on every + # authenticated REST request. Clients must send one of the internal service + # names (hg, store, hubble, vermeer) with this value as the password. + # CHANGE THIS IN PRODUCTION and keep it in sync with every client that calls + # the PD REST API (e.g. Hubble's operations.pd.password). Do not expose the + # REST port (8620) outside a trusted network. + secret-key: FXQXbJtbCLxODc6tGci732pkH1cyf8Qg Review Comment: ⚠️ The shipped PD image enables REST authentication with a fixed repository-published secret. The default HStore Compose files publish PD port 8620 to the host, so anyone who can reach that port can read this source/default and authenticate as an internal service against management endpoints. The README warning does not enforce a change. Please require a deployment-provided or generated secret, or fail startup when the public default is still in use. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
