pg.ddx.io pgsql-bugs@postgresql.org mailing list archive
help / color / mirror / Atom feedBUG #18802: password field in log
2+ messages / 2 participants
[nested] [flat]
* BUG #18802: password field in log
@ 2025-02-11 08:14 PG Bug reporting form <noreply@postgresql.org>
2025-02-11 08:30 ` Re: BUG #18802: password field in log Robert Sjöblom <robert.sjoblom@fortnox.se>
0 siblings, 1 reply; 2+ messages in thread
From: PG Bug reporting form @ 2025-02-11 08:14 UTC (permalink / raw)
To: pgsql-bugs@lists.postgresql.org; +Cc: roseduan7@163.com
The following bug has been logged on the website:
Bug reference: 18802
Logged by: roseduan
Email address: roseduan7@163.com
PostgreSQL version: 17.2
Operating system: CentOS
Description:
set log_statement to "all";
create user some_user password '123456';
And then I found that the password will show in the log file, is this an
expected behavior?
^ permalink raw reply [nested|flat] 2+ messages in thread
* Re: BUG #18802: password field in log
2025-02-11 08:14 BUG #18802: password field in log PG Bug reporting form <noreply@postgresql.org>
@ 2025-02-11 08:30 ` Robert Sjöblom <robert.sjoblom@fortnox.se>
0 siblings, 0 replies; 2+ messages in thread
From: Robert Sjöblom @ 2025-02-11 08:30 UTC (permalink / raw)
To: pgsql-bugs@lists.postgresql.org
On 2025-02-11 09:14, PG Bug reporting form wrote:
> The following bug has been logged on the website:
>
> Bug reference: 18802
> Logged by: roseduan
> Email address: roseduan7@163.com
> PostgreSQL version: 17.2
> Operating system: CentOS
> Description:
>
> set log_statement to "all";
>
> create user some_user password '123456';
>
> And then I found that the password will show in the log file, is this an
> expected behavior?
>
Yes, this is the expected behavior; there are several threads about this
on the various mailing lists, here's the first I fond:
https://www.postgresql.org/message-id/CAHJZqBDe1-oiYtdh5pcWLAhr3jsDMFQg4miv3PYADH3YWKqZ2w%40mail.gma...
A solution is to override the log statement while setting the password:
BEGIN;
SET LOCAL log_statement = 'none';
ALTER USER ... SET PASSWORD ...;
COMMIT;
Another would be to prepare the digest client-side instead, and use
\password in psql.
Best regards,
Robert Sjöblom
--
Innehållet i detta e-postmeddelande är konfidentiellt och avsett endast för
adressaten.Varje spridning, kopiering eller utnyttjande av innehållet är
förbjuden utan tillåtelse av avsändaren. Om detta meddelande av misstag
gått till fel adressat vänligen radera det ursprungliga meddelandet och
underrätta avsändaren via e-post
^ permalink raw reply [nested|flat] 2+ messages in thread
end of thread, other threads:[~2025-02-11 08:30 UTC | newest]
Thread overview: 2+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2025-02-11 08:14 BUG #18802: password field in log PG Bug reporting form <noreply@postgresql.org>
2025-02-11 08:30 ` Robert Sjöblom <robert.sjoblom@fortnox.se>
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox