4 ms·

> HTTP authentication Just clarifying, do you mean basic auth with the `Authorization: Basic base64(username : password)` scheme?

matthewaveryusa 5y ago
yeah -- updated.
blenderdt 5y ago
Which can also be sent in the URL like: https://username:password@example.com https://username:password@example.com But this is of course even worse because most servers log this. Headers are not often logged.
- VWWHFSfQ 5y ago
  I'm fairly certain that's just a convenience. The HTTP client will transform that into basic auth header in the actual request
  - blenderdt 5y ago
    Interesting. I wonder what really happens because I sometimes use this when I need to send an Authorization header to a location behind basic auth. As far as I know only Nginx accepts multiple Authorization headers.
    - VWWHFSfQ 5y ago
      Just testing it out with netcat, I can see the client is sending it as regular basic auth header: $ nc -l 127.0.0.1 8000 GET / HTTP/1.1 Host: 127.0.0.1:8000 User-Agent: python-requests/2.22.0 Accept-Encoding: gzip, deflate Accept: */* Connection: keep-alive Authorization: Basic dGVzdDp0ZXN0 >>> requests.get("http://test:test@127.0.0.1:8000")
      - eatonphil 5y ago
        And if you also pass an Authorization header it just drops the basic auth header (tested against a mirror server): $ curl http://user:pass@localhost:8080 GET / HTTP/1.1 Host: localhost:8080 User-Agent: curl/7.79.1 Accept: */* Authorization: Basic dXNlcjpwYXNz $ curl -H 'Authorization: Token blobbity' http://user:pass@localhost:8080 GET / HTTP/1.1 Host: localhost:8080 User-Agent: curl/7.79.1 Accept: */* Authorization: Token blobbity
- tinus_hn 5y ago
  Most servers obviously by default do not log the password, all of the ones I checked do not even have a way to do so.
- lillecarl 5y ago
  "Use of the format "user:password" in the userinfo field is deprecated." https://www.ietf.org/rfc/rfc3986.txt https://www.ietf.org/rfc/rfc3986.txt FYI

matthewaveryusa 5y ago

yeah -- updated.

blenderdt 5y ago

Which can also be sent in the URL like: https://username:password@example.com https://username:password@example.com But this is of course even worse because most servers log this. Headers are not often logged.

VWWHFSfQ 5y ago
I'm fairly certain that's just a convenience. The HTTP client will transform that into basic auth header in the actual request
- blenderdt 5y ago
  Interesting. I wonder what really happens because I sometimes use this when I need to send an Authorization header to a location behind basic auth. As far as I know only Nginx accepts multiple Authorization headers.
  - VWWHFSfQ 5y ago
    Just testing it out with netcat, I can see the client is sending it as regular basic auth header: $ nc -l 127.0.0.1 8000 GET / HTTP/1.1 Host: 127.0.0.1:8000 User-Agent: python-requests/2.22.0 Accept-Encoding: gzip, deflate Accept: */* Connection: keep-alive Authorization: Basic dGVzdDp0ZXN0 >>> requests.get("http://test:test@127.0.0.1:8000")
    - eatonphil 5y ago
      And if you also pass an Authorization header it just drops the basic auth header (tested against a mirror server): $ curl http://user:pass@localhost:8080 GET / HTTP/1.1 Host: localhost:8080 User-Agent: curl/7.79.1 Accept: */* Authorization: Basic dXNlcjpwYXNz $ curl -H 'Authorization: Token blobbity' http://user:pass@localhost:8080 GET / HTTP/1.1 Host: localhost:8080 User-Agent: curl/7.79.1 Accept: */* Authorization: Token blobbity
tinus_hn 5y ago
Most servers obviously by default do not log the password, all of the ones I checked do not even have a way to do so.
lillecarl 5y ago
"Use of the format "user:password" in the userinfo field is deprecated." https://www.ietf.org/rfc/rfc3986.txt https://www.ietf.org/rfc/rfc3986.txt FYI