CRIT Server 'unix_http_server' running without any HTTP authentication checking

[ngton]

This shouldn't be a CRIT level message, it's WARN at most.

As per the documentation:

username
The username required for authentication to this HTTP server.

Default: No username required.

Required: No.

Introduced: 3.0

If username is not a requirement, a CRIT message should not be generated.

[mnaberez]

This is logged at the highest level because it's a critical security concern. We allow supervisord to be run without authentication checking for things like local development, but we don't want it run without authentication in any kind of production environment. If you choose to run it that way, you'll still be able to do that, but by design you're going to have to endure this log message. I won't give you a way to turn this off, sorry.

[kellytk]

@mnaberez If only a [unix_http_server] block is configured, (meaning no [inet_http_server] block) no outside access to the HTTP server would be allowed. In that scenario, running without HTTP authentication seems reasonable. Would you explain why you disagree?

[mnaberez]

See comments attached to #717.

[yixuan178]

due to security issue, if there has any password/user in configuration is also not allowed, but w/o user/passowrd configuration, it will show warning message. any good solution for it?