nuts-foundation / nuts-foundation/nuts-node
Tracing configuration shows up in diagnostics
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 28
- Forks
- 23
- Avg merge
- 1d 10h
- Merged PRs (30d)
- 76
Description
Tracing config shows up in /status/diagnostics:
tracing:
tracing:
enabled: true
endpoint: aspire-stable:4318
insecure: true
service_name: node-stable
Why this is a bad idea:
The node's diagnostics are semi-public, some parties expose it to the public internet. We always recommended to keep internal, but never explicitly required parties to do so. The tracing info exposes internal details of the vendor's network.
Also, as it's also just mimicking config, there's no need to return this - it's not runtime information.
Fix
Remove it from diagnostics.
Backports
Backport to v6.2 (in which it was introduced).
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start at the /status/diagnostics endpoint and trace how the diagnostics response includes the tracing configuration. Remove that configuration from the response, then verify that diagnostics still work and no longer expose the tracing details. Check any existing diagnostics tests if present and ensure the change is suitable for the v6.2 backport.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- observability
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 72/100