ClickHouse / ClickHouse/clickhouse-cs
Unable to rotate password without overriding internal HTTP infrastructure
- Dominant language
- C#
- Stars
- 94
- Forks
- 22
- Avg merge
- 11h 26m
- Merged PRs (30d)
- 22
Description
---
### Package
ClickHouse.Driver
### Package Version
| Package Name | Version |
| ------------ | ------- |
| ClickHouse.Driver | 1.2.0 |
### Runtime Version
net10.0
### Description
Unfortunately, I was unable to compile the source code locally, so I'm filing an issue instead of a full-blown pull request.
### The problem
There is a need to periodically rotate the password used for authentication. The password may be different each time a new connection is opened. However, the current driver API does not provide a way to supply or refresh credentials at connection time — they are set once during initial setup and cannot be changed without creating a new driver instance.
This forces us to implement a workaround by overriding internal HTTP infrastructure. Specifically, we had to create a custom `HttpClientFactory` with a custom `HttpMessageHandler` that overwrites the `Authorization` header inside `SendAsync`/`Send` on every request:
```csharp
request.Headers.Authorization = new AuthenticationHeaderValue(
"Basic",
Convert.ToBase64String(Encoding.UTF8.GetBytes($"{username}:{currentPassword}")));
```
The driver should support password rotation natively, without requiring users to patch internal HTTP client factories and message handlers.
### The solution
Add a mechanism to the driver that allows one of the following:
1. Provide a credentials provider (callback / delegate) that is invoked every time a connection is established or a request is made.
2. At minimum, expose a way to override the authentication logic without patching internal factory classes.
### Steps to Reproduce
1. Configure the driver with a set of credentials.
2. Rotate the password externally.
3. Try to open a new connection or execute a query with the new password.
### Expected Result
The driver should be able to use the updated password without recreating the entire driver instance.
### Actual Result
The driver uses the old password. The only way to use a new password is to either recreate the driver instance or apply the workaround with a custom HTTP handler.
### Additional Context
Password rotation is a common security requirement in production environments. Having to recreate the entire driver instance or patch internal infrastructure adds unnecessary complexity and is error-prone.
Contributor guide
Research direction
Start by tracing how the driver API stores credentials and how its internal HttpClientFactory and HttpMessageHandler set authentication, including the SendAsync/Send paths mentioned in the issue. Compare connection-time and request-time credential needs, then define completion as password rotation working without recreating the driver or overriding internal HTTP infrastructure.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- csharp
- Domain
- authentication, backend-api-design
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100