Users can access data via HTTP API without any authentication

[tennix]

According to tidb-ctl documentation https://github.com/pingcap/tidb-ctl/blob/master/doc/tidb-ctl.md, users can access data via tidb-server HTTP API without authentication. This is a security vulnerability.

If users expose TiDB HTTP API unintentionally, or even internal non-authorized users can access TiDB data without requiring TiDB's user and password.

CockroachDB has the same issue but fixed in newer versions https://www.cockroachlabs.com/docs/advisories/a42567.html

We might need to fix this too.

[lysu]

@tennix after #15137, http ap user(include tidb-ctl) must provide cert/key and acess https after using cluster-allow-cn

[frank-dspeed]

@tennix @lysu you forgot to close this issue after merge :)

[lysu]

Thanks @frank-dspeed 😄 , I had discussed more about this with @tennix offline, after #15137 we could solve a part of the problem when the user enable HTTPS, but maybe need more improvement to keep safe for user that didn't enable https or do more fine-grain control in http api later

[dveeden]

Looks like #12317 is more or less the same issue?