[jira] [Commented] (VFS-854) SoftRefFilesCache logs password when FS is closed

["Michael Osipov (Jira)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/VFS-854?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17850081#comment-17850081 ] 

Michael Osipov commented on VFS-854:
------------------------------------

Well, it does log the URL, not the password. You should maybe provide the creds separately. Using auth info is deprecated in recent RFCs.

> SoftRefFilesCache logs password when FS is closed
> -------------------------------------------------
>
>                 Key: VFS-854
>                 URL: https://issues.apache.org/jira/browse/VFS-854
>             Project: Commons VFS
>          Issue Type: Bug
>    Affects Versions: 2.9.0
>            Reporter: Andrey Turbanov
>            Priority: Major
>
> We use DEBUG logging enabled for VFS to diagnose integration problems with external connections.
> Unfortunately it leads to logging of clear text password in logs if use basic auth with SFTP/HTTP4S connectors
> {noformat}
> D 240526 060013.993 [ScheduledIpfSynchronizer_Worker-1] SoftRefFilesCache - Close FileSystem: http4s://mylogin:mypassword@my.company.com:8443/
> {noformat}



--
This message was sent by Atlassian Jira
(v8.20.10#820010)