hasura / hasura/graphql-engine

Discourage and eventually discontinue database connection strings in metadata

Open
#9,022 2 comments 4 reactions 0 assignees View on GitHub
c/console c/docs estimate/S k/enhancement
Dominant language
TypeScript
Stars
32.1k
Forks
3k
PR merge metrics
PR metrics pending

Description

### Is your proposal related to a problem?

Database connection strings stored in metadata can easily lead to users accidentally leaking connection details.
For this reason, we recommend the use of environment variables instead. This is acknowledged in the [documentation](https://hasura.io/docs/latest/projects/create/#existing-database) and the console UI:
> Note You can connect to databases either using env vars or by using their raw connection string/parameters. It is recommended to use env vars for better security (as connection details are part of Hasura metadata) as well as to allow configuring different databases in different environments (like staging/production) easily.

![image](https://user-images.githubusercontent.com/25712958/192527726-4006a494-1aec-41d9-a74b-205a3545180b.png)

However, our documentation continues to show [examples of connecting to a database that store the connection string in the metadata instead of environment variables](https://hasura.io/docs/latest/databases/connect-db/cloud-databases/digital-ocean/).

Users should be discouraged from storing any sensitive information in metadata.

### Describe the solution you'd like

1. Documentation examples should show how to connect to a database with a connection string stored in an environment variable
2. The console should show a clear warning when a connection string is stored in metadata
3. In the console, the default should be to connect a database via environment variable (currently default is connection string)
4. Eventually, ability to connect a database via a connection string stored in metadata should be discontinued

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.