Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Don't output whole timers map; hash headers in rust #1411

Merged
merged 1 commit into from
Feb 23, 2025

Conversation

vlad-ivanov-name
Copy link
Collaborator

@vlad-ivanov-name vlad-ivanov-name commented Feb 23, 2025

  • The auth timers map can become quite big due to reasons described in Limit size of auth cache keyed by HTTP password #1412; don't output the whole map to tracing, just its size
  • Hash headers in rust instead of calling C lib. While initially I tried this as a fix for a different problem that didn't work, I decided to keep it, just because sha256 is a bit more up-to-date on security: since we hash without any extra salt and the format of source string is known, hypothetically rainbow tables could be used, etc. Using sha256 will make it more difficult.

@vlad-ivanov-name vlad-ivanov-name merged commit 92d228b into master Feb 23, 2025
1 check passed
@vlad-ivanov-name vlad-ivanov-name deleted the vlad/hash-headers-in-rust-fix-tracing branch February 23, 2025 16:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants