Question about Peer configuration API

General
1

Hello !

I just found something I’m not sure about the peer configuration API. It returns the details about a Peer and that’s fine.

However if I set the Username and Password when I perform a GET /peers/{id}/configuration the Password field is always returned null.

Here is a sample response:

{
   "HttpHeaders" : [],
   "Password" : null,
   "Pkcs11" : false,
   "Timeout" : 0,
   "Url" : "http://gateway:8042/",
   "Username" : "orthanc"
}

Is it an intended behavior ? Not a big deal but if that field is always null maybe it’s not relevant to return it at all :smiley:.

Thanks !

2

Hi, I can’t comment on the official background, but this is correct. It should not be possible to fetch a password once set. This follows best security practices.
Hth.
James

1 Like
3

Hello,

This field is intentionally kept to indicate that, although Username is present, Password has not been omitted by mistake, but is unavailable for security reasons. Although this may seem pedantic, removing the field could introduce backward compatibility issues in some client applications.

Regards,
Sébastien-

1 Like
4

PS: As a complement, check out the associated comments in the source code.

1 Like
5

Thank you for the details and the link !