Conversation
While not ideal from a security standpoint, the basic auth with the username and password in the URL is sometimes used. New deployments (and things outside testing) should prefer to use netrc or token instead of passing the password in URL.
|
Thanks for testing! However, I don't understand why the proposed change is needed: basic authentication from user info in the URL works with libcurl out of the box when I test. How did you see that username/password were not being propagated from the test URL? Regarding the test suite: yes, automated tests of the helper are indeed missing and would be great to have. I think they should be in this repo instead of in ccache, though. What's your view on this? |
|
Hmm, maybe I misunderstood the test failure. I thought it failed without and worked with, but no... Closing PR.
I was trying to replace the built-in http and redis with the storage helpers, so was testing end-to-end. So this was more of a transition phase, when I was testing if it worked without the built-in helpers. |
While not ideal from a security standpoint, the basic auth with the username and password in the URL is sometimes used.
New deployments (and things outside testing) should prefer to use netrc or token instead of passing the password in URL.
While testing the regular remote_http with helper instead of builtin, I found that it was failing in two places:
But I think the test case should probably be relaxed in ccache instead, to accept anything with
401in it?