GlcoinCore/btcd
1
0
Fork 0
mirror of https://github.com/btcsuite/btcd.git synced 2026-08-13 12:32:51 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

rpcclient: make HTTP Basic Auth optional via DisableAuth

Browse source 
Add a DisableAuth field to ConnConfig that, when set to true, skips
setting the Authorization header on RPC requests.

This enables connecting to third-party RPC providers (e.g. Alchemy,
GetBlock) that authenticate via API key in the URL path and reject
requests containing an Authorization header with 401 errors.

Previously, getAuth() unconditionally set BasicAuth or attempted
cookie auth, leaving no way to disable authentication entirely.

Fixes #2505
This commit is contained in:
Drake Thomsen 2026-03-27 10:00:31 -04:00 • committed by Olaoluwa Osuntokun
parent 891b3fc8cc
commit 5d22b395b8
1 changed files with 25 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

38
rpcclient/infrastructure.go
View file

@ -811,11 +811,13 @@ retryloop:
}
// Configure basic access authorization.
user, pass, authErr := config.getAuth()
if authErr != nil {
return nil, authErr
if !config.DisableAuth {
user, pass, authErr := config.getAuth()
if authErr != nil {
return nil, authErr
}
httpReq.SetBasicAuth(user, pass)
}
httpReq.SetBasicAuth(user, pass)
httpResponse, err = httpClient.Do(httpReq)
@ -1330,6 +1332,12 @@ type ConnConfig struct {
// EnableBCInfoHacks is an option provided to enable compatibility hacks
// when connecting to blockchain.info RPC server
EnableBCInfoHacks bool
// DisableAuth instructs the client to skip setting the Authorization
// header on RPC requests. This is useful when connecting to third-party
// RPC providers that authenticate via API key in the URL path and
// reject requests containing an Authorization header with 401 errors.
DisableAuth bool
}
// getAuth returns the username and passphrase that will actually be used for
@ -1469,16 +1477,20 @@ func dial(config *ConnConfig) (*websocket.Conn, error) {
dialer.NetDial = proxy.Dial
}
// The RPC server requires basic authorization, so create a custom
// request header with the Authorization header set.
user, pass, err := config.getAuth()
if err != nil {
return nil, err
}
login := user + ":" + pass
auth := "Basic " + base64.StdEncoding.EncodeToString([]byte(login))
// Configure basic access authorization. When DisableAuth is set, skip
// setting the Authorization header entirely. This is useful for
// third-party RPC providers that authenticate via API key in the URL
// path and reject requests containing an Authorization header.
requestHeader := make(http.Header)
requestHeader.Add("Authorization", auth)
if !config.DisableAuth {
user, pass, err := config.getAuth()
if err != nil {
return nil, err
}
login := user + ":" + pass
auth := "Basic " + base64.StdEncoding.EncodeToString([]byte(login))
requestHeader.Add("Authorization", auth)
}
for key, value := range config.ExtraHeaders {
requestHeader.Add(key, value)
}