[ruby-core:33300] [Ruby 1.9-Feature#4071] support basic auth for Net::HTTP.get requests

Issue #4071 has been updated by coderrr ..


It seems to me you're being very pedantic on the deprecation issue.  The only way I see the deprecation's sentiment applying to Ruby is in the sense that if Ruby supports this, then it will be a small incentive for people to continue using URIs this way and in turn cause some security issues for someone somewhere.  I don't think it's Ruby's job to take the lead in complying 100% to the URI RFC.  The fact that many other big HTTP clients still support this says to me there is a benefit to continuing supporting it that outweighs the costs:  it's a well known concise way of specifying basic auth info for a web site.  If most of the other http clients had gone the way of removing the functionality from their code I wouldn't be arguing.  But it seems to me it's still a somewhat informal standard.  Also Ruby is such a small % of the HTTP client market, whether or not we support it is most likely not going to make any impact to how URIs are used as a whole.

I agree there are or could be other concise ways of doing this in Ruby (I personally prefer net/http over open-uri) but I don't think that means we shouldn't consider this one.  The other thing is, in many cases, regardless of how you pass the user/password as basic auth, it's going to be coming from a plaintext source anyway which is what the RFC cites as its main reason for deprecation.

Why not just accept the patch and add a line to Net::HTTP.get rdoc mentioning the deprecation of using URI in this way?
----------------------------------------
http://redmine.ruby-lang.org/issues/show/4071

----------------------------------------
http://redmine.ruby-lang.org