Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Sign up
Appearance settings

Add Basic Authentication documentation and enhance InfluxDB migration auth guide #255

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
KanavCode wants to merge 4 commits into questdb:main
base: main
Choose a base branch
Loading
from KanavCode:basic-auth-docs

Conversation

@KanavCode
Copy link

@KanavCode KanavCode commented Oct 4, 2025

Changes Made

New Documentation

  • Basic Authentication Page (operations/basic-auth.md)
    • Complete configuration guide with server.conf examples
    • Client integration examples for all supported languages

Enhanced Documentation

  • InfluxDB Migration Guide (guides/influxdb-migration.md)
    • New authentication migration section
    • Configuration matrix comparing InfluxDB vs QuestDB auth
    • Step-by-step migration process with code examples
    • Security considerations for production environments

Copy link

CLAassistant commented Oct 4, 2025 •
edited
Loading

CLA assistant check
All committers have signed the CLA.

Copy link
Author

Hi, @javier, Please Check and Merge My Commit.

Copy link
Contributor

javier commented Oct 13, 2025

Thanks, @KanavCode . I would need the contributor agreement signed. Otherwise the automation doesn't allow me to preview and approve

Copy link
Author

Thanks, @KanavCode . I would need the contributor agreement signed. Otherwise the automation doesn't allow me to preview and approve

Yeah, Please Do.

Copy link
Contributor

javier commented Oct 14, 2025

Thanks, @KanavCode . I would need the contributor agreement signed. Otherwise the automation doesn't allow me to preview and approve

Yeah, Please Do.

Did you sign the CLA? The CLAAssistant comment above failed to verify it

Copy link
Author

Thanks, @KanavCode . I would need the contributor agreement signed. Otherwise the automation doesn't allow me to preview and approve

Yeah, Please Do.

Did you sign the CLA? The CLAAssistant comment above failed to verify it

Yupp, Done 👍
javier reacted with thumbs up emoji

Copy link
Contributor

@javier javier left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks! A nice contribution, but I am afraid it needs some work before we can publish it


HTTP Basic Authentication provides a simple method to secure access to QuestDB's HTTP endpoints, including the REST API, Web Console, and Health Check endpoints.

This authentication method requires users to provide a username and password with each request, making it ideal for development environments and simple production setups.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I would refrain from recommending this for production. Basic auth sends everything unencrypted, so it is very unsafe unless you have a proxy with TLS, which would be out of the scope of this guide

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I would move the note you have below about enterprise to this point instead

- **Web Console Access Control**: Protect the web console interface
- **Health Check Security**: Optional authentication for monitoring endpoints
- **Client Library Integration**: Built-in support across all QuestDB client libraries
- **Multiple User Support**: Configure different users with varying access levels
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is misleading, as it allows just for one admin user and a readonly user. I think it would be best to say "Both the built-in admin and the optional read-only user can be configured for Basic Auth"

- **Health Check Security**: Optional authentication for monitoring endpoints
- **Client Library Integration**: Built-in support across all QuestDB client libraries
- **Multiple User Support**: Configure different users with varying access levels

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I would move this note at the intro, before the Overview, so Enterprise users can skip the page completely

http.health.check.authentication.required=true

# Optional: Configure security settings
http.security.max.response.rows=10000
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I wouldn't feature the max response rows parameter here, as it has nothing to do with Basic Auth

http.security.max.response.rows=10000
http.security.readonly=false

# Optional: CORS settings for web applications
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

3. **Test Thoroughly**: Verify all integrations work with authentication enabled
4. **Monitor Logs**: Watch for authentication failures after deployment

```bash
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This example doesn't really says much, as client applications are not mentioned, and also coordinating application deployment with server restart can be tricky. I would rather leave the whole example out. You already mentioned how to configure and how to test earlier in the same page

curl -u "questdb_user:secure_password_123" http://localhost:9000/ping
```

## Next Steps
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I would delete everything from this point on. Some things are unrelated, and some things are enterprise-only, which we already mentioned at the initial note.


# For QuestDB Open Source without authentication:
# client = InfluxDBClient(url="http://localhost:9000", token="")

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why are you removing the enterprose option for user and password? Even if token is recommended, user and password for enterprise work as well

print(f"Authentication failed: {e}")
```

### Environment Variables Migration
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I would remove this section. Not sure it is needed, and it is misleading as these variables are only for SERVER SIDE, not for client

Or individual variables

export QDB_HTTP_USER="admin"
export QDB_HTTP_PASSWORD="quest"

and the QDB_URL variable is not used by either client or server

export QDB_URL="http://localhost:9000"
```

### Security Considerations
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I would remove this section. Some things are enterprise only, and the rest are very mild generic recommendations

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@javier javier javier requested changes

Requested changes must be addressed to merge this pull request.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

AltStyle によって変換されたページ (->オリジナル) /