influxdata / influxdata/influxdb
unauthenticated /metrics endpoint
Nobody has claimed this yet.
- Dominant language
- Rust
- Stars
- 31.7k
- Forks
- 3.7k
- Avg merge
- 13h 37m
- Merged PRs (30d)
- 8
Description
I am running influxdb:2.6.1 docker from docker hub...
I have noticed /health and /metrics endpoints which are relative to our domain unauthenticated.. Based on https://docs.influxdata.com/influxdb/v2.6/api/#tag/Health those endpoints should be Token Authenticated.. I have noticed /api/v2/metrics require an authentication. Especially the /metrics endpoint may contain sensitive information.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce the behavior with influxdb:2.6.1 in Docker and compare /health, /metrics, and /api/v2/metrics with and without a token. Trace the handlers and authentication checks for these endpoints; done means the documented token requirement is enforced and regression coverage verifies unauthenticated access is rejected.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker, rust
- Domain
- api, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100