Qlik Community

Integration, Extension & APIs

Discussion board where members can learn more about Integration, Extensions and API’s for Qlik Sense.

Announcements
QlikWorld 2022, LIVE in Denver CO., May 16-19, 2022. REGISTER NOW TO RECEIVE EARLY BIRD PRICING
cancel
Showing results for 
Search instead for 
Did you mean: 
gandalfgray
Specialist II
Specialist II

Passwords of dataconnections exposed in clear text via Repository Service api

Hi

I have noticed that using the Repository Service api you can retrieve all data connections passwords in clear text. Man Surprised

That seems like a bad solution. Is there any plans to change this?

2 Replies
Gysbert_Wassenaar

I doubt it. It's the kind of thing the Repository API is created for. The communication with the Repository API is encrypted with the QS certifcate. So it's not exactly plain text for everybody. You need access to the QS certificates. And if you have that you basically 'own' that QS installation. Which is why you shouldn't leave those certificates lying around where anyone can get their hands on them.


talk is cheap, supply exceeds demand
gandalfgray
Specialist II
Specialist II
Author

Hi Gysbert!

Thanks for your reply.

I did not say anyone could do it.

You can if you know how to setup the api calls it, it's not hard.

 

I am questioning if there are any usecases that validates this behaviour.