search

seanmonstar / reqwest

An easy and powerful Rust HTTP Client
https://docs.rs/reqwest
Apache License 2.0
9.93k stars 1.12k forks source link

clarify that RequestBuilder::basic_auth uses http 1.1 basic authentication, not the http 1.0 #2439

Closed lolbinarycat closed 1 month ago

lolbinarycat commented 1 month ago

the Basic authentication type is defined twice, once in RFC 1945, and again in RFC 2617. the latter (the one used by reqwest) uses base64 encoding, while the former does not. this should be noted in a doc comment.

lolbinarycat commented 1 month ago

changing the current comment to "Enable HTTP basic authentication as defined by RFC 2617" should be enough.

seanmonstar commented 1 month ago

The "basic" auth scheme was updated long ago, and the IANA only refers to the one that uses base64 encoding (https://www.iana.org/assignments/http-authschemes/http-authschemes.xhtml). I don't think there's a need to specify "we use the IANA standard".

lolbinarycat commented 1 month ago

counterpoint: the current doc comment is 4 letters long. that's not very helpful.

i was struggling with an oauth2 api, and one of the few things the docs said was "make sure to base64 encode it". this lead me on a fruitless journey of reading 5 different RFCs and a good chunk of reqwest's source code.

it's also not implausible for someone to read the original HTTP specification out of academic curiosity, then not read the subsequent RFCs.

it's also plausible that certain resources on http are out of date. the original format is also easier to remember due to the similarity with the userdata section of urls.

while it may seem implausible, somehow i had only retained the 1.0 version of the Basic spec. so perhaps it's not as obvious as it seems.