hasura / hasura/graphql-engine
UI showing warning about admin secret being unset while it is set
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 32.1k
- Forks
- 3k
- PR merge metrics
- PR metrics pending
Description
Version Information
Server Version:
CLI Version (for CLI related issue): v2.14.0
Environment
OSS
What is the current behaviour?
UI shows a little icon on the header indicating a warning with this text:
This graphql endpoint is public and you should add an admin-secretThis graphql endpoint is public and you should add an admin-secret
What is the expected behaviour?
No warning as the admin secret is set (see logs).
Screenshots or Screencast
Please provide any traces or logs that could help here.
{
"detail": {
"info": {
"admin_secret_set": true,
"auth_hook": null,
"auth_hook_mode": null,
"console_assets_dir": null,
"console_sentry_dsn": null,
"cors_config": {
"allowed_origins": "*",
"disabled": false,
"ws_read_cookie": null
},
"enable_allowlist": false,
"enable_console": false,
"enable_maintenance_mode": false,
"enable_metadata_query_logging": false,
"enable_telemetry": true,
"enabled_apis": [
"pgdump",
"metadata",
"developer",
"graphql"
],
"enabled_log_types": [
"startup",
"webhook-log",
"http-log",
"websocket-log"
],
"events_fetch_batch_size": 100,
"experimental_features": [],
"graceful_shutdown_timeout": 60,
"infer_function_permissions": true,
"jwt_secret": [
{
"audience": null,
"claims_format": "json",
"claims_namespace": "https://hasura.io/jwt/claims",
"header": null,
"issuer": null,
"key": "<JWK REDACTED>",
"type": "<TYPE REDACTED>"
}
],
"live_query_options": {
"batch_size": 100,
"refetch_delay": 1
},
"log_level": "info",
"port": 8080,
"remote_schema_permissions": true,
"server_host": "HostAny",
"stringify_numeric_types": false,
"transaction_isolation": "ISOLATION LEVEL READ COMMITTED",
"unauth_role": null,
"use_prepared_statements": true,
"v1-boolean-null-collapse": false,
"websocket_compression_options": "NoCompression",
"websocket_connection_init_timeout": "Refined (Seconds {seconds = 3s})",
"websocket_keep_alive": "KeepAliveDelay {unKeepAliveDelay = Refined (Seconds {seconds = 5s})}"
},
"kind": "server_configuration"
},
"level": "info",
"timestamp": "2022-11-02T16:23:31.748+0000",
"type": "startup"
}
Any possible solutions/workarounds you're aware of?
Possible reason is how detection is done, the container is running in ECS and the access key is set via a secret.
Keywords
admin secret
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No files or tests are named. Start by reproducing the UI header warning and compare its detection with the server_configuration startup log, particularly the admin_secret_set value; done means the warning is absent when the admin secret is set.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- graphql, typescript
- Domain
- frontend, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100