You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@airflow.apache.org by "LukePaytec (via GitHub)" <gi...@apache.org> on 2025/07/25 11:19:25 UTC
[I] Connection passwords visible in UI [airflow]
LukePaytec opened a new issue, #53753:
URL: https://github.com/apache/airflow/issues/53753
### Apache Airflow version
3.0.3
### If "Other Airflow 2 version" selected, which one?
_No response_
### What happened?
In airflow 3.0.2 the `AIRFLOW__CORE__HIDE_SENSITIVE_VAR_CONN_FIELDS` is set to True and you are not allowed to see passwords, secrets ect, as they are hidden with `***`. However when updating to airflow 3.0.3 the connections are accessible through the UI.
### What you think should happen instead?
I would keep the passwords hashed and hidden from the UI. Seen in this image it should be like:
<img width="861" height="373" alt="Image" src="https://github.com/user-attachments/assets/ede6e247-6117-485f-bff1-3d94c7833077" />
and not like this where someone can go grab it
<img width="861" height="449" alt="Image" src="https://github.com/user-attachments/assets/ec99421d-8d7c-41bf-9555-2d0962de1345" />
### How to reproduce
Make sure that you have airflow 3.0.2 installed and go make a connection. You will see the passwords are not filtered and show raw on the frontend UI.
### Operating System
We tried on linux x64 and on arm64
### Versions of Apache Airflow Providers
```
apache-airflow-providers-amazon==9.9.0
apache-airflow-providers-celery==3.12.1
apache-airflow-providers-cncf-kubernetes==10.6.1
apache-airflow-providers-common-compat==1.7.2
apache-airflow-providers-common-io==1.6.1
apache-airflow-providers-common-messaging==1.0.4
apache-airflow-providers-common-sql==1.27.3
apache-airflow-providers-docker==4.4.1
apache-airflow-providers-elasticsearch==6.3.1
apache-airflow-providers-fab==2.3.0
apache-airflow-providers-ftp==3.13.1
apache-airflow-providers-git==0.0.4
apache-airflow-providers-google==16.1.0
apache-airflow-providers-grpc==3.8.1
apache-airflow-providers-hashicorp==4.3.1
apache-airflow-providers-http==5.3.2
apache-airflow-providers-microsoft-azure==12.5.0
apache-airflow-providers-mysql==6.3.2
apache-airflow-providers-odbc==4.10.1
apache-airflow-providers-openlineage==2.5.0
apache-airflow-providers-postgres==6.2.1
apache-airflow-providers-redis==4.1.1
apache-airflow-providers-sendgrid==4.1.2
apache-airflow-providers-sftp==5.3.2
apache-airflow-providers-slack==9.1.2
apache-airflow-providers-smtp==2.1.1
apache-airflow-providers-snowflake==6.5.0
apache-airflow-providers-ssh==4.1.1
apache-airflow-providers-standard==1.4.1
```
### Deployment
Official Apache Airflow Helm Chart
### Deployment details
Using k8s we deployed using the helm chart on the arm64 machine and used argo to deploy on the linux machine.
### Anything else?
This bug happens every time and I suspect its not a big issue which can be resolved for next release.
### Are you willing to submit PR?
- [ ] Yes I am willing to submit a PR!
### Code of Conduct
- [x] I agree to follow this project's [Code of Conduct](https://github.com/apache/airflow/blob/main/CODE_OF_CONDUCT.md)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Connection passwords visible in UI [airflow]
Posted by "pierrejeambrun (via GitHub)" <gi...@apache.org>.
pierrejeambrun commented on issue #53753:
URL: https://github.com/apache/airflow/issues/53753#issuecomment-3132842122
This change seems to be deliberate, introduced in https://github.com/apache/airflow/pull/52403 and I really do not understand the motivation there. That seems plain wrong but I might be missing some context. (Basically you can query the API and retrieve sensitive fields unmasked with that, which completely defeat the purpose of `AIRFLOW__CORE__HIDE_SENSITIVE_VAR_CONN_FIELDS`)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Connection passwords visible in UI [airflow]
Posted by "vikramkoka (via GitHub)" <gi...@apache.org>.
vikramkoka commented on issue #53753:
URL: https://github.com/apache/airflow/issues/53753#issuecomment-3130140523
cc: @vatsrahul1001
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Connection passwords visible in UI [airflow]
Posted by "boring-cyborg[bot] (via GitHub)" <gi...@apache.org>.
boring-cyborg[bot] commented on issue #53753:
URL: https://github.com/apache/airflow/issues/53753#issuecomment-3117421071
Thanks for opening your first issue here! Be sure to follow the issue template! If you are willing to raise PR to address this issue please do so, no need to wait for approval.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Connection passwords visible in UI [airflow]
Posted by "ashb (via GitHub)" <gi...@apache.org>.
ashb commented on issue #53753:
URL: https://github.com/apache/airflow/issues/53753#issuecomment-3132911185
@pierrejeambrun Agreed, That change needs reverting and 3.0.4 released immediately. The UI should be updated to not try to send the password then the form is submitted.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Connection passwords visible in UI [airflow]
Posted by "jroachgolf84 (via GitHub)" <gi...@apache.org>.
jroachgolf84 commented on issue #53753:
URL: https://github.com/apache/airflow/issues/53753#issuecomment-3117609813
> Make sure that you have airflow 3.0.2 installed and go make a connection. You will see the passwords are not filtered and show raw on the frontend UI.
Just to validate, this is for Airflow 3.0.2, or 3.0.3?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Connection passwords visible in UI [airflow]
Posted by "pierrejeambrun (via GitHub)" <gi...@apache.org>.
pierrejeambrun closed issue #53753: Connection passwords visible in UI
URL: https://github.com/apache/airflow/issues/53753
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Connection passwords visible in UI [airflow]
Posted by "vatsrahul1001 (via GitHub)" <gi...@apache.org>.
vatsrahul1001 commented on issue #53753:
URL: https://github.com/apache/airflow/issues/53753#issuecomment-3130790915
Verified this is a new bug introduced in 3.0.3. This works fine with 3.0.2
cc: @pierrejeambrun
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Connection passwords visible in UI [airflow]
Posted by "shubhamraj-git (via GitHub)" <gi...@apache.org>.
shubhamraj-git commented on issue #53753:
URL: https://github.com/apache/airflow/issues/53753#issuecomment-3133691964
There were other reasons discussed on [thread](https://apache-airflow.slack.com/archives/C0809U4S1Q9/p1751108215738019), which saw potential in removing that. But if we have `AIRFLOW__CORE__HIDE_SENSITIVE_VAR_CONN_FIELDS` to configure that accordingly then it makes complete sense to have it. Thanks @pierrejeambrun
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org