From 95987388f26b4788b4f7078e598d0b9ce4c24b4e Mon Sep 17 00:00:00 2001 From: David Weber Date: Wed, 24 May 2023 20:53:36 +0200 Subject: [PATCH] fix: don't expose sensible data Signed-off-by: David Weber --- .changeset/selfish-carrots-sneeze.md | 5 +++++ plugins/proxy-backend/config.d.ts | 12 +++++++++++- 2 files changed, 16 insertions(+), 1 deletion(-) create mode 100644 .changeset/selfish-carrots-sneeze.md diff --git a/.changeset/selfish-carrots-sneeze.md b/.changeset/selfish-carrots-sneeze.md new file mode 100644 index 0000000000..e0a88744dc --- /dev/null +++ b/.changeset/selfish-carrots-sneeze.md @@ -0,0 +1,5 @@ +--- +'@backstage/plugin-proxy-backend': patch +--- + +The headers `Authorization` and `X-Api-Key` are sensitive and must be declared a secret. diff --git a/plugins/proxy-backend/config.d.ts b/plugins/proxy-backend/config.d.ts index 59fc0dc5a6..410ff86a2e 100644 --- a/plugins/proxy-backend/config.d.ts +++ b/plugins/proxy-backend/config.d.ts @@ -31,7 +31,17 @@ export interface Config { /** * Object with extra headers to be added to target requests. */ - headers?: { [key: string]: string }; + headers?: Partial<{ + /** @visibility secret */ + Authorization: string; + /** @visibility secret */ + authorization: string; + /** @visibility secret */ + 'X-Api-Key': string; + /** @visibility secret */ + 'x-api-key': string; + [key: string]: string; + }>; /** * Changes the origin of the host header to the target URL. Default: true. */