Skip to content

Handle basic http authentication#5

Closed
afbjorklund wants to merge 1 commit intoccache:mainfrom
afbjorklund:basic
Closed

Handle basic http authentication#5
afbjorklund wants to merge 1 commit intoccache:mainfrom
afbjorklund:basic

Conversation

@afbjorklund
Copy link
Copy Markdown

@afbjorklund afbjorklund commented Apr 9, 2026

While not ideal from a security standpoint, the basic auth with the username and password in the URL is sometimes used.

New deployments (and things outside testing) should prefer to use netrc or token instead of passing the password in URL.


While testing the regular remote_http with helper instead of builtin, I found that it was failing in two places:

  1. The basic auth "pass" was failing, due to the username/password not being propagated from test URL
    export CCACHE_REMOTE_STORAGE="http://somebody:secret123@localhost:12780"
  1. The basic auth "fail" was failing, due to the log message "HTTP 401" not matching "status code: 401"

But I think the test case should probably be relaxed in ccache instead, to accept anything with 401 in it?

While not ideal from a security standpoint, the basic auth
with the username and password in the URL is sometimes used.

New deployments (and things outside testing) should prefer to
use netrc or token instead of passing the password in URL.
@jrosdahl
Copy link
Copy Markdown
Member

Thanks for testing!

However, I don't understand why the proposed change is needed: basic authentication from user info in the URL works with libcurl out of the box when I test. How did you see that username/password were not being propagated from the test URL?

Regarding the test suite: yes, automated tests of the helper are indeed missing and would be great to have. I think they should be in this repo instead of in ccache, though. What's your view on this?

@afbjorklund
Copy link
Copy Markdown
Author

afbjorklund commented Apr 11, 2026

Hmm, maybe I misunderstood the test failure. I thought it failed without and worked with, but no...

Closing PR.

I think they should be in this repo instead of in ccache, though. What's your view on this?

I was trying to replace the built-in http and redis with the storage helpers, so was testing end-to-end.
Eventually it would probably be enough with unit tests within this repository, and only "test" helper?

So this was more of a transition phase, when I was testing if it worked without the built-in helpers.

@afbjorklund afbjorklund deleted the basic branch April 11, 2026 10:53
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants