[
https://issues.apache.org/jira/browse/VFS-854?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17850081#comment-17850081
]
Michael Osipov commented on VFS-854:
------------------------------------
Well, it does log the URL, not the password. You should maybe provide the creds
separately. Using auth info is deprecated in recent RFCs.
> SoftRefFilesCache logs password when FS is closed
> -------------------------------------------------
>
> Key: VFS-854
> URL: https://issues.apache.org/jira/browse/VFS-854
> Project: Commons VFS
> Issue Type: Bug
> Affects Versions: 2.9.0
> Reporter: Andrey Turbanov
> Priority: Major
>
> We use DEBUG logging enabled for VFS to diagnose integration problems with
> external connections.
> Unfortunately it leads to logging of clear text password in logs if use basic
> auth with SFTP/HTTP4S connectors
> {noformat}
> D 240526 060013.993 [ScheduledIpfSynchronizer_Worker-1] SoftRefFilesCache -
> Close FileSystem: http4s://mylogin:[email protected]:8443/
> {noformat}
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
