influxdata / influxdata/influxdb
Authentication for debug endpoints only works if pprof is enabled
Nobody has claimed this yet.
- Dominant language
- Rust
- Stars
- 31.7k
- Forks
- 3.7k
- Avg merge
- 13h 37m
- Merged PRs (30d)
- 8
Description
List the minimal actions needed to reproduce the behavior.
- Disable pprof:
pprof-auth-enabled = true
pprof-enabled = false
- Make a request to the debug endpoints
http://localhost:8086/debug/requests
http://localhost:8086/debug/vars
Expected behavior:
Either pprof-enabled = false should also disable the requests/vars debug endpoints, or pprof-auth-enabled should also work when pprof is disabled, or there should be a separate auth setting for the pprof independent debug endpoints
Actual behavior:
With pprof disabled, the debug endpoints are callable without authentication and no way to add authentication directly in influxdb except for enabling pprof
Environment info:
- System info:
Linux 3.10.0-1062.4.1.el7.x86_64 x86_64
- InfluxDB version:
InfluxDB v1.8.3 (git: 1.8 563e6c3d1a7a2790763c6289501095dbec19244e)
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the behavior with pprof-auth-enabled=true and pprof-enabled=false, then inspect the /debug/requests and /debug/vars entry points and how they apply authentication. Done means the chosen authentication or disabling behavior is implemented consistently and verified for both endpoints.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- backend, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 32/100