Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

Mask the credentials when reading the stream config from streams API

Open
  • Is something wrong?
#111 5 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
42/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Stale
Tech stack
go
Domain
api, security

Research direction

Start at the Streams API GET /streams/{id} endpoint and trace how existing stream configurations are serialized. Inspect the input definitions for fields marked secret, then check the relevant Streams API tests or add focused coverage. Done means secret fields such as account_key and connection_string are masked while non-secret configuration values remain unchanged.

Written by the indexing model from the issue text.

Description

bug configuration

The current benthos Streams API provide a good way to dynamically create and manage the streams. However, when reading an existing stream config via GET /streams/{id} endpoint, it would be better to mask all the credential fields or at least provide an option to mask them.

For example, currently when getting a stream with azure_cosmosdb as input, the response is like this:

{
  "active": true,
  "uptime": 222.438774375,
  "uptime_str": "3m42.438774667s",
  "config": {
    "input": {
      "azure_cosmosdb": {
        "account_key": "adfs",
        "args_mapping": "root = [\n  { \"Name\": \"@name\", \"Value\": \"benthos\" },\n]",
        "auto_replay_nacks": true,
        "batch_count": -1,
        "connection_string": "sdfa",
        "container": "testcontainer",
        "database": "testdb",
        "endpoint": "https://localhost:8081",
        "partition_keys_map": "root = \"blobfish\"",
        "query": "SELECT c.foo FROM testcontainer AS c WHERE c.bar = \"baz\" AND c.timestamp < @timestamp"
      }
    },
    "output": {
      "stdout": {
        "codec": "lines"
      }
    }
  }
}

Expected response would be:

{
  "active": true,
  "uptime": 222.438774375,
  "uptime_str": "3m42.438774667s",
  "config": {
    "input": {
      "azure_cosmosdb": {
        "account_key": "!!!SECRET_SCRUBBED!!!",
        "args_mapping": "root = [\n  { \"Name\": \"@name\", \"Value\": \"benthos\" },\n]",
        "auto_replay_nacks": true,
        "batch_count": -1,
        "connection_string": "!!!SECRET_SCRUBBED!!!",
        "container": "testcontainer",
        "database": "testdb",
        "endpoint": "https://localhost:8081",
        "partition_keys_map": "root = \"blobfish\"",
        "query": "SELECT c.foo FROM testcontainer AS c WHERE c.bar = \"baz\" AND c.timestamp < @timestamp"
      }
    },
    "output": {
      "stdout": {
        "codec": "lines"
      }
    }
  }
}

Both account_key and connection_string should be masked because they are marked as secret fields in the input definations.

Dominant language
Go
Stars
571
Forks
121
Avg merge
1d 13h
Merged PRs (30d)
15

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from redpanda-data/benthos

All issues in redpanda-data/benthos

Similar issues

More Go issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.