Document that hashed credentials can be used without 'webserver-hash-plaintext-creden...

diff --git a/docs/settings.rst b/docs/settings.rst
index 423a588afc73c6643e5e48333434d5e52f685ea2..6d2c3b69853980725c2d599eb7bb17a811beadd7 100644 (file)
--- a/docs/settings.rst
+++ b/docs/settings.rst
@@ -137,7 +137,7 @@ Enable/disable the :doc:`http-api/index`.
 .. versionchanged:: 4.6.0
   This setting now accepts a hashed and salted version.
 
-Static pre-shared authentication key for access to the REST API. Since 4.6.0 the key can be hashed and salted using ``pdnsutil hash-password`` instead of being stored in the configuration in plaintext.
+Static pre-shared authentication key for access to the REST API. Since 4.6.0 the key can be hashed and salted using ``pdnsutil hash-password`` instead of being stored in the configuration in plaintext, but the plaintext version is still supported.
 
 .. _setting-autosecondary:
 
@@ -1783,7 +1783,8 @@ Webserver/API access is only allowed from these subnets.
 -  Boolean
 -  Default: no
 
-Whether passwords and API keys supplied as plaintext should be hashed during startup, to prevent the plaintext versions from staying in memory. Doing so increases significantly the cost of verifying credentials.
+Whether passwords and API keys supplied in the configuration as plaintext should be hashed during startup, to prevent the plaintext versions from staying in memory. Doing so increases significantly the cost of verifying credentials and is thus disabled by default.
+Note that this option only applies to credentials stored in the configuration as plaintext, but hashed credentials are supported without enabling this option.
 
 .. _setting-webserver-loglevel:
 
@@ -1844,7 +1845,7 @@ Maximum request/response body size in megabytes.
 
 -  String
 
-Password required to access the webserver. Since 4.6.0 the password can be hashed and salted using ``pdnsutil hash-password`` instead of being in plaintext.
+Password required to access the webserver. Since 4.6.0 the password can be hashed and salted using ``pdnsutil hash-password`` instead of being present in the configuration in plaintext, but the plaintext version is still supported.
 
 .. _setting-webserver-port:
 

diff --git a/pdns/recursordist/docs/settings.rst b/pdns/recursordist/docs/settings.rst
index 750a98ea7c64c5d6bf0674162b2ef325ffba6259..0023719f5cfaef926381dc37a23c38d30cb0cd74 100644 (file)
--- a/pdns/recursordist/docs/settings.rst
+++ b/pdns/recursordist/docs/settings.rst
@@ -101,7 +101,7 @@ Directory where the REST API stores its configuration and zones.
 -  String
 -  Default: unset
 
-Static pre-shared authentication key for access to the REST API. Since 4.6.0 the key can be hashed and salted using ``rec_control hash-password`` instead of being stored in the configuration in plaintext.
+Static pre-shared authentication key for access to the REST API. Since 4.6.0 the key can be hashed and salted using ``rec_control hash-password`` instead of being stored in the configuration in plaintext, but the plaintext version is still supported.
 
 .. _setting-api-readonly:
 
@@ -2119,7 +2119,8 @@ of /32 or /128.
 -  Boolean
 -  Default: no
 
-Whether passwords and API keys supplied as plaintext should be hashed during startup, to prevent the plaintext versions from staying in memory. Doing so increases significantly the cost of verifying credentials.
+Whether passwords and API keys supplied in the configuration as plaintext should be hashed during startup, to prevent the plaintext versions from staying in memory. Doing so increases significantly the cost of verifying credentials and is thus disabled by default.
+Note that this option only applies to credentials stored in the configuration as plaintext, but hashed credentials are supported without enabling this option.
 
 .. _setting-webserver-loglevel:
 
@@ -2172,7 +2173,7 @@ The value between the hooks is a UUID that is generated for each request. This c
 -  String
 -  Default: unset
 
-Password required to access the webserver. Since 4.6.0 the password can be hashed and salted using ``rec_control hash-password`` instead of being in plaintext.
+Password required to access the webserver. Since 4.6.0 the password can be hashed and salted using ``rec_control hash-password`` instead of being present in the configuration in plaintext, but the plaintext version is still supported.
 
 .. _setting-webserver-port: