Skip to content

fix: clear CRIT message from supervisord #2440

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Oct 23, 2024
Merged

fix: clear CRIT message from supervisord #2440

merged 1 commit into from
Oct 23, 2024

Conversation

VietND96
Copy link
Member

@VietND96 VietND96 commented Oct 23, 2024

User description

Thanks for contributing to the Docker-Selenium project!
A PR well described will help maintainers to quickly review and merge it

Before submitting your PR, please check our contributing guidelines, applied for this repository.
Avoid large PRs, help reviewers by making them as simple and short as possible.

Description

Clear the CRIT message from supervisord

2024-10-22 05:28:35,874 CRIT Server 'unix_http_server' running without any HTTP authentication checking

Motivation and Context

Types of changes

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to change)

Checklist

  • I have read the contributing document.
  • My change requires a change to the documentation.
  • I have updated the documentation accordingly.
  • I have added tests to cover my changes.
  • All new and existing tests passed.

PR Type

Bug fix


Description

  • Added HTTP authentication to the supervisorctl section in the supervisord.conf file to clear the CRIT message about running without authentication.
  • This change addresses the security warning and ensures that the server is not running without any HTTP authentication checking.

Changes walkthrough 📝

Relevant files
Bug fix
supervisord.conf
Add HTTP authentication to supervisord configuration         

Base/supervisord.conf

  • Added username and password configuration for supervisorctl.
  • Enhanced security by enabling HTTP authentication.
  • +2/-0     

    💡 PR-Agent usage: Comment /help "your question" on any pull request to receive relevant information

    Signed-off-by: Viet Nguyen Duc <nguyenducviet4496@gmail.com>
    Copy link

    PR Reviewer Guide 🔍

    Here are some key observations to aid the review process:

    ⏱️ Estimated effort to review: 1 🔵⚪⚪⚪⚪
    🧪 No relevant tests
    🔒 Security concerns

    Hardcoded credentials:
    The PR introduces a hardcoded password 'secret' for supervisorctl authentication. While adding authentication is a step in the right direction, using a hardcoded password is a security risk. It's recommended to use an environment variable or a more secure method to manage this credential.

    ⚡ Recommended focus areas for review

    Hardcoded Secret
    The password for supervisorctl is hardcoded as 'secret'. This is a security risk and should be replaced with an environment variable or a more secure method of storing credentials.

    Copy link

    PR Code Suggestions ✨

    Explore these optional code suggestions:

    CategorySuggestion                                                                                                                                    Score
    Security
    Use an environment variable for the password instead of hardcoding it

    Instead of hardcoding the password, use an environment variable for better security
    and flexibility.

    Base/supervisord.conf [28-29]

     username=%(ENV_SEL_USER)s
    -password=secret
    +password=%(ENV_SEL_PASSWORD)s
    • Apply this suggestion
    Suggestion importance[1-10]: 9

    Why: The suggestion improves security by replacing a hardcoded password with an environment variable, reducing the risk of exposing sensitive information in the configuration file. This change is highly relevant and impactful for maintaining secure practices.

    9

    💡 Need additional feedback ? start a PR chat

    @VietND96 VietND96 merged commit 693e213 into trunk Oct 23, 2024
    49 of 52 checks passed
    @VietND96 VietND96 deleted the supervisord branch October 23, 2024 08:47
    Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
    Projects
    None yet
    Development

    Successfully merging this pull request may close these issues.

    1 participant