4 ms·

Interesting. I wonder what really happens because I sometimes use this when I need to send an Authorization header to a location behind basic auth. As far as I

• VWWHFSfQ 4y ago
  Just testing it out with netcat, I can see the client is sending it as regular basic auth header: $ nc -l 127.0.0.1 8000 GET / HTTP/1.1 Host: 127.0.0.1:8000 User-Agent: python-requests/2.22.0 Accept-Encoding: gzip, deflate Accept: */* Connection: keep-alive Authorization: Basic dGVzdDp0ZXN0 >>> requests.get("http://test:test@127.0.0.1:8000")
  • eatonphil 4y ago
    And if you also pass an Authorization header it just drops the basic auth header (tested against a mirror server): $ curl http://user:pass@localhost:8080 GET / HTTP/1.1 Host: localhost:8080 User-Agent: curl/7.79.1 Accept: */* Authorization: Basic dXNlcjpwYXNz $ curl -H 'Authorization: Token blobbity' http://user:pass@localhost:8080 GET / HTTP/1.1 Host: localhost:8080 User-Agent: curl/7.79.1 Accept: */* Authorization: Token blobbity