fix(dashboard): stop sending database connection strings to the browser - #893
Merged
Conversation
The root loader returned the raw DatabaseConfig list, and React Router serializes a loader's return value into the HTML for hydration. Every configured connection string — passwords included — was therefore readable in page source by anyone who could load the dashboard, and with DATABASE_URL="...|..." that is every database the instance monitors. Basic auth limits who can reach the page, but it is a single shared credential and does not make this acceptable: viewing a dashboard should not hand over the credentials to write to the databases behind it. Project to a PublicDatabase on the server instead. The schema stays — it is not a credential, and the database selector renders it for any non-default schema. Only `url` is dropped, and no client code ever read it: the sidebar uses id, name and schema and nothing else. Verified with a live server on a URL containing a marker password: zero occurrences across /, /jobs, /queues and /warnings. The regression test fails 3 of its 5 cases against the unfixed loader. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HfGQCtytuqzDGxUch1tpCx
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The root loader returned the raw DatabaseConfig list, and React Router serializes a loader's return value into the HTML for hydration. Every configured connection string — passwords included — was therefore readable in page source by anyone who could load the dashboard, and with DATABASE_URL="...|..." that is every database the instance monitors.
Basic auth limits who can reach the page, but that's not a good excuse. This PR switches to a PublicDatabase on the server instead.