search

davazp / graphql-mode

An Emacs mode for GraphQL
GNU General Public License v3.0
162 stars 31 forks source link

Add support for authentication #33

Open fredefox opened 5 years ago

fredefox commented 5 years ago

I'd like to re-open #11. As a first iteration, graphql-mode could read ~/.authinfo prior to sending a request, check if there is a mapping for the host in question, and if so set the HTTP header Authorization using the basic access authentication as specified by RFC 7617: The 'Basic' HTTP Authentication Scheme.

davazp commented 5 years ago

@fredefox Thanks for bringing this up. Your proposal sounds good.

I know at least smtpmail.el supports .authinfo.. It seems it uses the auth-source library for it: https://www.gnu.org/software/emacs/manual/html_mono/auth.html

Are there any other modes with the same needs?

Also, are there any security concerns? I wonder why this isn't this built-in into request?

fredefox commented 5 years ago

Are there any other modes with the same needs? Just looking at my own .authinfo I can see that I'm using it for accessing a JIRA board. I forget which package implements this, though. I'm also using magit/magit-forge to access various Git "forges".

As for security concerns, a user can use .authinfo.gpg as an alternative. That file is expected to be encrypted. Of course storing passwords in clear-text files may pose security concerns in some cases.

I don't have a lot more details, because I don't really know how it's implemented. It's always easier just to ask for features than to put in the work ;)

I can't promise I'll dedicate time for this, but if you have pointers that could be useful for implementing this, please do share.