Hi — thanks for continuing to maintain the plugin, it's been running well for us.
One thing I ran into while auditing a reverse proxy in front of our InfluxDB instance: the plugin authenticates by putting the credentials in the query string.
POST /write?db=<db>&precision=ms&u=<user>&p=<password>
That works, but it means the password is written to the logs of everything the request passes through. In our case it was landing in four places:
- the reverse proxy's access log, in plaintext, on every write
- a log-analysis pipeline reading that file
- that pipeline's hosted console, since request context is forwarded with alerts
- the CDN sitting in front, which logs proxied requests its own side
Because metrics writes are high-frequency, this isn't occasional — the credential is written to disk on essentially every request. It also can't be scrubbed at the proxy without stripping query strings generally, which breaks the attack-detection rules that inspect them.
Suggestion
InfluxDB 1.x accepts HTTP Basic auth, which keeps the credential out of the URL entirely:
Authorization: Basic <base64 user:pass>
Same credentials and same endpoint, so it should be transparent to existing setups — the config keys wouldn't need to change, only how they're attached to the request.
InfluxDB 2.x uses Authorization: Token <token> similarly, if that's ever on the roadmap.
Possible constraint
I don't know whether the query-parameter form is a deliberate choice or a limitation of the HTTP client available inside the Rust server / Harmony environment. If custom request headers aren't reachable there, that would explain it — and it'd be useful to note in the README so people running the plugin behind a proxy know to expect it.
Happy to put together a PR if that would be useful when i have a bit more time and its not a constraint in the http client. Let me know which way you'd prefer to go.
Thanks
SETKEH
Hi — thanks for continuing to maintain the plugin, it's been running well for us.
One thing I ran into while auditing a reverse proxy in front of our InfluxDB instance: the plugin authenticates by putting the credentials in the query string.
That works, but it means the password is written to the logs of everything the request passes through. In our case it was landing in four places:
Because metrics writes are high-frequency, this isn't occasional — the credential is written to disk on essentially every request. It also can't be scrubbed at the proxy without stripping query strings generally, which breaks the attack-detection rules that inspect them.
Suggestion
InfluxDB 1.x accepts HTTP Basic auth, which keeps the credential out of the URL entirely:
Same credentials and same endpoint, so it should be transparent to existing setups — the config keys wouldn't need to change, only how they're attached to the request.
InfluxDB 2.x uses
Authorization: Token <token>similarly, if that's ever on the roadmap.Possible constraint
I don't know whether the query-parameter form is a deliberate choice or a limitation of the HTTP client available inside the Rust server / Harmony environment. If custom request headers aren't reachable there, that would explain it — and it'd be useful to note in the README so people running the plugin behind a proxy know to expect it.
Happy to put together a PR if that would be useful when i have a bit more time and its not a constraint in the http client. Let me know which way you'd prefer to go.
Thanks
SETKEH