web-push-libs / pywebpush

Python Webpush Data encryption library
Mozilla Public License 2.0
314 stars 53 forks source link

netrc may override authorization header. #156

Open jmgurney opened 10 months ago

jmgurney commented 10 months ago

I got pywebpush working on one system, but then when I copied it over to another system, I had authorization issues.

It turns out that the other system has a .netrc file that requests was reading and overriding the authorization set by vapid. This is documented here: https://github.com/web-push-libs/pywebpush:

If no authentication method is given with the auth argument, Requests will attempt to get the authentication credentials for the URL’s hostname from the user’s netrc file. The netrc file overrides raw HTTP authentication headers set with headers=.

I think the best thing to do is add an auth=lambda: None to the post line to disable reading the netrc file. I cannot think of a reason why we'd want this, but I'm also not well versed enough w/ the web PUSH api and it's edge cases to determine that either.