0

I have an application with the following tech stack

  • web frontend app in React
  • backend with Python/Django
  • GraphQL API using graphene + django-graphql-auth for authentication
  • MySQL DB
  • hosted on Heroku

In addition to this, the backend is also used by another 3rd party app that authenticates to it and sends data to track activity in a VR application.

I realized that in heroku logs, all the requests coming from the VR APP (made in Unity), are displaying the password field in plain text. This does not happen if I try to login through the web app.

enter image description here

Decoding the relevant part for more readability:

path="/graphql/?operationName=Login&query=mutation Login {
  tokenAuth(username: "ANNBAC", password: "4379") {
    success
    errors
    user {
      pk
    }
  }
}"

Given this scenario I believe the way the requests are being sent from Unity are the culprit. Problem is that I'm not Unity developer and would have no idea how to fix this there. I don't even have access to the code as it belongs to another team. And I think the unity devs there are also not so familiar with working with web requests in general so I don't know how to properly guide them on the web part. I could though ask for them to post whatever relevant code in here if people find necessary to help tracking the problem.

Rafael Santos
  • 293
  • 3
  • 18
  • Can you show us how your React app sends the login mutation to GraphQL? – ceejayoz Feb 02 '22 at 22:16
  • it would be a lot of code to put in here, so I'll try to have just the more relevant parts. Will post in a bit – Rafael Santos Feb 02 '22 at 22:25
  • @ceejayoz . I added now. Let me know if you got the relevant parts you'd hope. – Rafael Santos Feb 02 '22 at 22:34
  • I removed the react code and edited a lot of the question. Further investigation showed the problem to be related to requests coming from Unity and not the react app – Rafael Santos Feb 03 '22 at 16:47
  • I would make it their problem. "Your code is sending user credentials in the URL." Report it to your manager and whoever's in charge of security. – ceejayoz Feb 03 '22 at 18:08

0 Answers0