Hi :wave: we have a self-hosted Kratos instance an...
# talk-kratos
a
Hi 👋 we have a self-hosted Kratos instance and for one use-case we call the
/admin/recovery/code
endpoint to create a recovery code (via another service in our cluster), which is later given to the user via email. The problem: when following this recovery from the email, the end user can inspect sensitive information from the infrastructure, like the
request_url
(you can inspect that in the network tab, example: `https://kratos-admin.namespace.svc.cluster.local:PORTNUMBER/admin/recovery/code`), which is something everyone wants to prevent. I tried to apply some configuration via the Helm Chart, but that had no effect (and I also see no matching config for this). Imo, the cause is rather simple: the requested url is technically correct, but in a self-hosted scenario, with a non-public admin service, the info should be somehow anonymized, but isn't). Any advise? 🙏