kv.v2.list_secrets fails when LIST request not supported

[RomanTheLegend]

I've stumbled upon a problem that when LIST request is not supported, the library cannot extract the list of secrets from Vault, while the default client can (because it uses GET)

kv.v2.list_secrets(path="mysecret") will throw "Bad Request" exception

The problem is in this block:
https://github.com/hvac/hvac/blob/develop/hvac/api/secrets_engines/kv_v2.py#L328

Changing it to GET fixes the issue:

        api_path = utils.format_url(
            "/v1/{mount_point}/metadata/{path}?list=true", mount_point=mount_point, path=path
        )
        return self._adapter.get(
            url=api_path,
        )

for the reference, the official client uses GET too:

vault kv list -output-curl-string  secret/mysecret 
curl -H "X-Vault-Request: true" -H "X-Vault-Token: $(vault print token)" https://vault.example.com/v1/secret/metadata/mysecret?list=true

It would be good to have an overloaded method that explicitly uses GET as a request

[namenmalkav]

im having the same issue

[RomanTheLegend]

im having the same issue

Here's my quick&ugly workaround until the lib is fixed:

import json
import os
import requests


def list_secrets(folder):
    url = "{}/v1/secret/metadata/{}".format(os.environ['VAULT_ADDR'],requests.utils.quote(folder,safe=''))
    print(url)

    headers = {"X-Vault-Token" : os.environ['VAULT_TOKEN']}
    res = requests.get(url, params={"list":"true"} , headers=headers).content
    children = json.loads(res)["data"]["keys"]
    print(children)
    return children

[briantist]

Hi folks! We do have a method to force the use of GET requests for LIST operations.
To do so, you should create your own Adapter type. This could be as easy as subclassing the default JSONAdapter:

import hvac

class StrictAdapter(hvac.adapters.JSONAdapter):
    def __init__(self, *args, **kwargs):
        kwargs["strict_http"] = True
        super().__init__(*args, **kwargs)

client = hvac.Client(adapter=StrictAdapter)

---

To follow the flow of how that's used:

In the file linked in the OP, we see it the method call adapter.list:

hvac/hvac/api/secrets_engines/kv_v2.py

Line 330 in d7e9557

return self._adapter.list(

adapter.list calls adapter.request with the "list" method:

hvac/hvac/adapters.py

Line 162 in d7e9557

return self.request("list", url, **kwargs)

which in turn has code to check whether the method is list and if so, to change the request method to GET and add the list=true parameter, but only when strict_http is set to True (it defaults to False):

hvac/hvac/adapters.py

Lines 295 to 301 in d7e9557

	if self.strict_http and method.lower() in ("list",):
	# Entry point for standard HTTP substitution
	params = _kwargs.get("params", {})
	if method.lower() == "list":
	method = "get"
	params.update({"list": "true"})
	_kwargs["params"] = params

---

I think there's room for improvement here though.

An overload, or a new parameter is not quite what I'd recommend, because all list methods would need the same thing, not just kv2, and the issue of needing to use GET instead of LIST should be system wide (which is why it's in the adapter).

Instead I'd probably look to make one or more of the following changes:

• Allow the client to take a pre-created instance of an Adapter, and not just the class: it would be much easier to simply pass it in than to have to subclass it, hvac.Client(adapter=hvac.adapters.JSONAdapter(strict_http=True))
• Perhaps add a strict_http option to the Client constructor so it can be set there, to be passed into the Adapter, hvac.Client(strict_http=True)

I'll think about it a bit and open an issue, and probably a PR.