Sensitive data from extra fields is visible in Edit Connection window
- Dominant language
- Python
- Stars
- 46.9k
- Forks
- 17.8k
- Avg merge
- 2d 10h
- Merged PRs (30d)
- 483
Description
### Apache Airflow version
3.0.3
### If "Other Airflow 2 version" selected, which one?
_No response_
### What happened?
After upgrading Airflow from version 3.0.2 to 3.0.3 sensitive data in extra fields and extra fields JSON is visible in edit connection page.
### What you think should happen instead?
Sensitive data should be masked with ***
### How to reproduce
Enter Edit Connection window in Airflow UI.
### Operating System
Ubuntu 24.04
### Versions of Apache Airflow Providers
_No response_
### Deployment
Other Docker-based deployment
### Deployment details
Airflow deployed with Docker Swarm.
Settings in airflow.cfg:
- hide_sensitive_var_conn_fields = True
I also added the following after realising the issue occurred::
- sensitive_var_conn_names = private_key,private_key_passphrase
However, this did not change anything.
### Anything else?
_No response_
### Are you willing to submit PR?
- [ ] Yes I am willing to submit a PR!
### Code of Conduct
- [x] I agree to follow this project's [Code of Conduct](https://github.com/apache/airflow/blob/main/CODE_OF_CONDUCT.md)
Contributor guide
Research direction
Start by reproducing the issue in the Airflow UI's Edit Connection window using the reported 3.0.3 setup and the hide_sensitive_var_conn_fields and sensitive_var_conn_names settings. Check how extra fields and extra fields JSON are displayed; done means sensitive values are masked as *** in both views.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- frontend, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100