From: Tom Lane <tgl@sss.pgh.pa.us>
To: Matheus Alcantara <matheusssilv97@gmail.com>
cc: PostgreSQL Hackers <pgsql-hackers@lists.postgresql.org>
Subject: Re: Redact user password on pg_stat_statements
In-reply-to: <CAFY6G8eo3c0LyzmRA+wmpCnex-LOxsXpv_DK7WQ2pujmEH1nPg@mail.gmail.com>
References: <CAFY6G8eo3c0LyzmRA+wmpCnex-LOxsXpv_DK7WQ2pujmEH1nPg@mail.gmail.com>
Comments: In-reply-to Matheus Alcantara <matheusssilv97@gmail.com>
	message dated "Fri, 21 Feb 2025 12:33:15 -0300"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <3134385.1740154091.1@sss.pgh.pa.us>
Content-Transfer-Encoding: quoted-printable
Date: Fri, 21 Feb 2025 11:08:11 -0500
Message-ID: <3134386.1740154091@sss.pgh.pa.us>
Archived-At: <https://www.postgresql.org/message-id/3134386.1740154091%40sss.pgh.pa.us>
Precedence: bulk

Matheus Alcantara <matheusssilv97@gmail.com> writes:
> Attached a patch to redact the password value from pg_stat_statements_vi=
ew when
> executing:
> { CREATE|ALTER} {USER|ROLE|GROUP } identifier { [WITH] [ENCRYPTED]
> PASSWORD 'value' }

Please see previous threads about hiding this sort of information,
most recently [1].  It's a slippery slope for which there are no
real fixes, and even partial fixes like this one are horrid kluges.
One obvious objection to the direction you propose here is that it
does nothing for pg_stat_activity, nor for the server log if
log_statement is enabled.

The right answer is to never send cleartext passwords to the server
in the first place.

			regards, tom lane

[1] https://www.postgresql.org/message-id/flat/18817-771682052a364bfe%40po=
stgresql.org