Tracing configuration shows up in diagnostics

Open Beginner friendly
#4,450 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
72/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Quiet
Tech stack
go
Domain
observability

Research direction

Start at the /status/diagnostics endpoint and trace how the diagnostics response includes the tracing configuration. Remove that configuration from the response, then verify that diagnostics still work and no longer expose the tracing details. Check any existing diagnostics tests if present and ensure the change is suitable for the v6.2 backport.

Written by the indexing model from the issue text.

Description

bug

Tracing config shows up in /status/diagnostics:

tracing:
    tracing:
        enabled: true
        endpoint: aspire-stable:4318
        insecure: true
        service_name: node-stable

Why this is a bad idea:

The node's diagnostics are semi-public, some parties expose it to the public internet. We always recommended to keep internal, but never explicitly required parties to do so. The tracing info exposes internal details of the vendor's network.

Also, as it's also just mimicking config, there's no need to return this - it's not runtime information.

Fix

Remove it from diagnostics.

Backports

Backport to v6.2 (in which it was introduced).

Dominant language
Go
Stars
28
Forks
23
Avg merge
1d 10h
Merged PRs (30d)
76

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from nuts-foundation/nuts-node

All issues in nuts-foundation/nuts-node

Similar issues

More Go issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.