swagger-api / swagger-api/swagger-ui
don't expose credentials in displayed curl command
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 29k
- Forks
- 9.3k
- Avg merge
- 2d 23h
- Merged PRs (30d)
- 25
Description
Is your feature request related to a problem?
When using basic authentication, the curl command shown in the UI exposes a base64-encoded password. This resulted in a few users accidentally pasting those credentials into other systems in our organization.
Describe the solution you'd like
If basic auth is used, replace the Authorization header in the curl command with a -u flag, specifying only the user (so that when used, the user will be prompted for a password).
Additional context
I will have a PR ready later today, following an internal code review.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No file or test is named in the issue, so first locate the UI code that assembles and displays the curl command for basic authentication. Verify that the displayed command uses -u with only the username, omits the encoded password from the Authorization header, and prompts for the password when run.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- frontend
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100