ClickHouse / ClickHouse/clickhouse-cs

Unable to rotate password without overriding internal HTTP infrastructure

Open
#395 0 comments 2 reactions 0 assignees View on GitHub
Dominant language
C#
Stars
94
Forks
22
Avg merge
11h 26m
Merged PRs (30d)
22

Description

---

### Package
ClickHouse.Driver

### Package Version
| Package Name | Version |
| ------------ | ------- |
| ClickHouse.Driver | 1.2.0 |

### Runtime Version
net10.0

### Description
Unfortunately, I was unable to compile the source code locally, so I'm filing an issue instead of a full-blown pull request.

### The problem
There is a need to periodically rotate the password used for authentication. The password may be different each time a new connection is opened. However, the current driver API does not provide a way to supply or refresh credentials at connection time — they are set once during initial setup and cannot be changed without creating a new driver instance.

This forces us to implement a workaround by overriding internal HTTP infrastructure. Specifically, we had to create a custom `HttpClientFactory` with a custom `HttpMessageHandler` that overwrites the `Authorization` header inside `SendAsync`/`Send` on every request:

```csharp
request.Headers.Authorization = new AuthenticationHeaderValue(
"Basic",
Convert.ToBase64String(Encoding.UTF8.GetBytes($"{username}:{currentPassword}")));
```

The driver should support password rotation natively, without requiring users to patch internal HTTP client factories and message handlers.

### The solution
Add a mechanism to the driver that allows one of the following:
1. Provide a credentials provider (callback / delegate) that is invoked every time a connection is established or a request is made.
2. At minimum, expose a way to override the authentication logic without patching internal factory classes.

### Steps to Reproduce
1. Configure the driver with a set of credentials.
2. Rotate the password externally.
3. Try to open a new connection or execute a query with the new password.

### Expected Result
The driver should be able to use the updated password without recreating the entire driver instance.

### Actual Result
The driver uses the old password. The only way to use a new password is to either recreate the driver instance or apply the workaround with a custom HTTP handler.

### Additional Context
Password rotation is a common security requirement in production environments. Having to recreate the entire driver instance or patch internal infrastructure adds unnecessary complexity and is error-prone.

Contributor guide

Open the contributing guide

Research direction

Start by tracing how the driver API stores credentials and how its internal HttpClientFactory and HttpMessageHandler set authentication, including the SendAsync/Send paths mentioned in the issue. Compare connection-time and request-time credential needs, then define completion as password rotation working without recreating the driver or overriding internal HTTP infrastructure.

Written by the indexing model from the issue text.

Assessment

Tech stack
csharp
Domain
authentication, backend-api-design
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.