Skip to content

fix: mask webhook secret with password field and reveal toggle#6932

Open
talissoncosta wants to merge 2 commits intomainfrom
fix/scramble-webhook-secret
Open

fix: mask webhook secret with password field and reveal toggle#6932
talissoncosta wants to merge 2 commits intomainfrom
fix/scramble-webhook-secret

Conversation

@talissoncosta
Copy link
Contributor

@talissoncosta talissoncosta commented Mar 12, 2026

  • I have read the Contributing Guide.
  • I have added information to docs/ if required so people know about the feature.
  • I have filled in the "Changes" section below.
  • I have filled in the "How did you test this code" section below.

Changes

Closes #6724

Webhook secret masking

The webhook secret was displayed as plain text when editing an existing webhook. Changed the secret input from type='text' to type='password' in both environment and audit log webhook forms.

The existing Input component already provides a built-in eye/eye-off toggle button for password fields, so the secret is now:

  • Masked by default (•••••)
  • Revealable via the eye icon toggle

Files changed:

  • CreateWebhook.tsx — environment webhook secret input
  • CreateAuditLogWebhook.tsx — audit log webhook secret input

Eye icon logic fix

While implementing the above, we found the eye/eye-off icon logic in Input.js was inverted — it showed eye-off (crossed eye) when the field was hidden, and eye (open eye) when visible. This affected all password fields across the app.

Fixed to follow the standard convention:

  • Hiddeneye icon (click to reveal)
  • Visibleeye-off icon (click to hide)

File changed:

  • Input.js — swapped icon condition

How did you test this code?

  1. Go to Environment Settings > Webhooks > edit an existing webhook
  2. Verify the secret field is masked with dots
  3. Click the eye icon — verify it shows eye when masked, eye-off when revealed
  4. Click again to hide it
  5. Repeat for Organisation Settings > Audit Log Webhooks
  6. Check any other password field in the app (e.g. login) — verify the icon logic is correct

🤖 Generated with Claude Code

Changes the secret input from type='text' to type='password' in both
environment and audit log webhook forms. The Input component already
provides an eye/eye-off toggle for password fields.

Closes #6724

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@talissoncosta talissoncosta requested a review from a team as a code owner March 12, 2026 12:23
@talissoncosta talissoncosta requested review from Zaimwa9 and removed request for a team March 12, 2026 12:23
@vercel
Copy link

vercel bot commented Mar 12, 2026

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
flagsmith-frontend-preview Ready Ready Preview, Comment Mar 12, 2026 0:27am
flagsmith-frontend-staging Ready Ready Preview, Comment Mar 12, 2026 0:27am
1 Skipped Deployment
Project Deployment Actions Updated (UTC)
docs Ignored Ignored Preview Mar 12, 2026 0:27am

Request Review

@github-actions github-actions bot added front-end Issue related to the React Front End Dashboard fix labels Mar 12, 2026
@github-actions
Copy link
Contributor

github-actions bot commented Mar 12, 2026

Docker builds report

Image Build Status Security report
ghcr.io/flagsmith/flagsmith-api-test:pr-6932 Finished ✅ Skipped
ghcr.io/flagsmith/flagsmith-e2e:pr-6932 Finished ✅ Skipped
ghcr.io/flagsmith/flagsmith-api-test:pr-6932 Finished ✅ Skipped
ghcr.io/flagsmith/flagsmith-e2e:pr-6932 Finished ✅ Skipped
ghcr.io/flagsmith/flagsmith-api:pr-6932 Finished ✅ Results
ghcr.io/flagsmith/flagsmith-api:pr-6932 Finished ✅ Results
ghcr.io/flagsmith/flagsmith:pr-6932 Finished ✅ Results
ghcr.io/flagsmith/flagsmith-private-cloud:pr-6932 Finished ✅ Results
ghcr.io/flagsmith/flagsmith:pr-6932 Finished ✅ Results
ghcr.io/flagsmith/flagsmith-private-cloud:pr-6932 Finished ✅ Results
ghcr.io/flagsmith/flagsmith-frontend:pr-6932 Finished ✅ Results

The eye icon was inverted — showing eye-off when hidden and eye when
visible. Now shows eye (click to reveal) when masked, and eye-off
(click to hide) when visible.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@github-actions
Copy link
Contributor

github-actions bot commented Mar 12, 2026

Playwright Test Results (oss - depot-ubuntu-latest-arm-16)

passed  10 passed

Details

stats  10 tests across 7 suites
duration  11.1 seconds
commit  b0fc6b1
info  🔄 Run: #15257 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-16)

passed  10 passed

Details

stats  10 tests across 7 suites
duration  45.9 seconds
commit  b0fc6b1
info  🔄 Run: #15257 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-16)

passed  10 passed

Details

stats  10 tests across 7 suites
duration  46 seconds
commit  d31d250
info  🔄 Run: #15258 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-arm-16)

passed  10 passed

Details

stats  10 tests across 7 suites
duration  11 seconds
commit  d31d250
info  🔄 Run: #15258 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-arm-16)

passed  2 passed

Details

stats  2 tests across 2 suites
duration  1 minute, 11 seconds
commit  b0fc6b1
info  🔄 Run: #15257 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-16)

passed  2 passed

Details

stats  2 tests across 2 suites
duration  1 minute, 12 seconds
commit  b0fc6b1
info  🔄 Run: #15257 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-arm-16)

passed  2 passed

Details

stats  2 tests across 2 suites
duration  1 minute, 4 seconds
commit  d31d250
info  🔄 Run: #15258 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-16)

passed  1 passed

Details

stats  1 test across 1 suite
duration  1 minute, 2 seconds
commit  d31d250
info  🔄 Run: #15258 (attempt 1)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

fix front-end Issue related to the React Front End Dashboard

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Scramble the webhook secret in the settings UI

1 participant