Re: [PATCH] http: add option to try authentication without username

From: Jeff King <peff@peff.net>
Date: Feb 15, 2016, 20:34 UTC
Message-ID: <20160215203451.GA29705@sigill.intra.peff.net>
In-Reply-To: <20160215202937.GA57185@vauxhall.crustytoothpaste.net>

On Mon, Feb 15, 2016 at 08:29:37PM +0000, brian m. carlson wrote:

Show 15 quoted lines

> > Rather than sprinkling curl_empty_auth special cases here and there,
> > would it be possible to simply set http_auth.username and
> > http_auth.password to empty strings early on if they are not already
> > set and curl_empty_auth is true, and then let the:
> > 
> >     strbuf_addf(&up, "%s:%s",
> >         http_auth.username, http_auth.password);
> > 
> > in init_curl_http_auth() handle them in the normal fashion, with the
> > end result being the same ":" set explicitly by this patch?
> 
> That would work.  I was concerned about the credential_fill call
> actually prompting the user, but it appears that it doesn't do that if
> the password already exists.  I don't know if we want to rely on that
> functionality, though.

Yeah, credential_fill() will treat that as a noop, as it is no different than getting "https://user:pass@example.com" in the URL in the first place. But it will _also_ send the result to credential_approve() and credential_reject(), which you probably don't want (because you do not want to store these useless dummy credentials in your keystore).

So I think this hack should remain purely at the curl level, and never touch the credential struct at all.

Which is a shame, because I think Eric's suggestion is otherwise much more readable. :)

-Peff