Passwords exposed in URIs

An application stores URIs to be used for file transfers via SFTP, FTP, FTPS and SCP. Many of these URIs contain passwords, for example:

sftp://someuser:[email protected]/

These URIs are visible to too many people. We cannot hide email addresses from these people.

A mini-language to get passwords out of URIs

Using a mini-DSL, we can specify the parts of the email address we don't want to show:


The program that does the file transfer would look for instances of this mini-DSL in the URI, parse them, look up the appropriate strings from restricted sources, and substitute those strings into the URI. For example, supposing that restricted source contains this key/value pair:

customers/widgitco/password: moresekrit

Then, after replacement, the URI should be:

sftp://someuser:[email protected]/

Each instance of the mini-DSL within the URI would be delimited with << and >>. Details of the mini-DSL between the << and >> would be free to vary in order to meet future requirements; the only requirement would be that it contain no >>.

This would achieve my goal of reducing the exposure of these passwords.

Is this mini-language fragile?

  • Are there valid FTP/FTPS/SFTP/SCP URIs which will break this scheme?
  • Are they at all likely?
  • What mini-DSL is less likely to be broken by valid URIs?
  • 2
    Why even bother with this kind of scheme? I mean what's the point? Usernames and passwords don't need to be stored in the URL. In fact, they really shouldn't be. I also think it's a bit much to call this a "mini-DSL" - it's a simple string substitution.
    – Aaronaught
    Feb 20, 2014 at 18:23
  • 1
    @Aaronaught - You're right. I plead "legacy code" and throw myself on the mercy of the court. The ability to transfer files by FTP &c. was grafted onto a system that thinks it is only sending email. At one time, these URIs were only email addresses. Feb 20, 2014 at 18:38
  • Why do the username and passwords need to be stored in the URI? Why not have a generic mechanism to lookup the username/password based on the URI, instead? Do you really need to have a custom lookup mechanism per URI ?
    – Pete
    Feb 20, 2014 at 21:48
  • @Pete In this system there is, with few exceptions, a one-to-on mapping between URIs and passwords, so the lookup is generally per-URI. Feb 20, 2014 at 21:53
  • If you generally have a one-to-one mapping between URIs and passwords, why not simply model it as such? Store URIs minus passwords, and have a separate table/configuration/store where given input of URI, returns the password for that URI. Why some custom mini-DSL just for this?
    – Pete
    Feb 20, 2014 at 21:55

1 Answer 1

  • Are there valid FTP/FTPS/SFTP/SCP URIs which will break this scheme? Yes. Any user that has a password containing "<" or "> is likely to cause problems.
  • Are they at all likely? Absolutely, since you don't have any control over the passwords used by the users (presumably).
  • What mini-DSL is less likely to be broken by valid URIs? None. Any un-escaped string substitution model, which is all this really is, is going to have problems.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.