4 ms·
Which can also be sent in the URL like: https://username:password@example.com https://username:password@example.com But this is of course even worse because mo
by blenderdt 4y ago
Which can also be sent in the URL like: https://username:password@example.com https://username:password@example.com
But this is of course even worse because most servers log this. Headers are not often logged.
- VWWHFSfQ 4y agoI'm fairly certain that's just a convenience. The HTTP client will transform that into basic auth header in the actual request
- blenderdt 4y agoInteresting. I wonder what really happens because I sometimes use this when I need to send an Authorization header to a location behind basic auth. As far as I know only Nginx accepts multiple Authorization headers.
- VWWHFSfQ 4y agoJust testing it out with netcat, I can see the client is sending it as regular basic auth header: $ nc -l 127.0.0.1 8000 GET / HTTP/1.1 Host: 127.0.0.1:8000 User-Agent: python-requests/2.22.0 Accept-Encoding: gzip, deflate Accept: */* Connection: keep-alive Authorization: Basic dGVzdDp0ZXN0 >>> requests.get("http://test:test@127.0.0.1:8000")
- eatonphil 4y agoAnd if you also pass an Authorization header it just drops the basic auth header (tested against a mirror server): $ curl http://user:pass@localhost:8080 GET / HTTP/1.1 Host: localhost:8080 User-Agent: curl/7.79.1 Accept: */* Authorization: Basic dXNlcjpwYXNz $ curl -H 'Authorization: Token blobbity' http://user:pass@localhost:8080 GET / HTTP/1.1 Host: localhost:8080 User-Agent: curl/7.79.1 Accept: */* Authorization: Token blobbity
- tinus_hn 4y agoMost servers obviously by default do not log the password, all of the ones I checked do not even have a way to do so.
- lillecarl 4y ago"Use of the format "user:password" in the userinfo field is deprecated." https://www.ietf.org/rfc/rfc3986.txt https://www.ietf.org/rfc/rfc3986.txt FYI