prysmaticlabs / prysm

Go implementation of Ethereum proof of stake
https://www.offchainlabs.com
GNU General Public License v3.0
3.49k stars 1.03k forks source link

Support basic auth in beacon.Client [regression] #13854

Open theexoticman opened 8 months ago

theexoticman commented 8 months ago

Describe the bug

The beacon.Client hostname handling does not extract username and password from basicauth, so the request to an execution client protected by a reverse proxy using basic auth will fail.

Has this worked before in a previous version?

Yes - ref: https://github.com/prysmaticlabs/prysm/pull/10632

🔬 Minimal Reproduction

~/consensus/dist/beacon-chain-v5.0.3-linux-amd64 --execution-endpoint=http://$USERNAME:$PASSWORD@toto.com --sepolia --jwt-secret=~/consensus/jwt.hex --checkpoint-sync-url=https://sepolia.beaconstate.info --genesis-beacon-api-url=https://sepolia.beaconstate.info

Error

[2024-04-05 18:09:22] ERROR execution: Could not connect to execution endpoint error=could not verify execution chain ID as your connection is not authenticated. If connecting to your execution client via HTTP, you will need to set up JWT authentication. See our documentation here https://docs.prylabs.network/docs/execution-node/authentication: 401 Unauthorized: 401 Authorization Required

401 Authorization Required
==========================

* * *

nginx/1.18.0 (Ubuntu)

### Platform(s)

Linux (x86)

### What version of Prysm are you running? (Which release)

v5.0.0 - v5.0.3 and maybe before

### Anything else relevant (validator index / public key)?

_No response_
james-prysm commented 6 months ago

sorry for the late response,

After some investigating, I don't believe this was ever supported. the other PR linked was for client connections using basic auth on checkpoint sync. the connection between the beacon node and execution client works a bit different. from checking histories of our code it seems you can either do basic auth or jwt not both. although I'm not sure about the execution client support.

my question to you is if other clients you've worked with have this feature, we can evaluate next steps on getting it implemented.