[ruby-core:33372] Re: [Ruby 1.9-Feature#4071] support basic auth for Net::HTTP.get requests

Hi

On Thu, Nov 25, 2010 at 3:15 AM, NARUSE, Yui <[e-mail]> wrote:
> Please explain some more.

Let me start over.

The class URI::HTTP has two attributes named 'user' and 'password'. I
feel these can not be removed for compatibility reasons. If you
disagree, please say so. Otherwise, we have to accept that the
information is there (even if you/some RFC think it's a bad idea).

Note that setters exist too, so they can be specified in other ways
than with through the "user:pass@...":
u = URI("https://github.com")
u.user = "bob"
u.password = "foo"

The Net::HTTP.get and Net::HTTP.post_form both accept a URI::HTTP
argument. I feel they should deal with all the information provided by
the URI::HTTP class.

This includes 'user' and 'password'. Currently, `get` doesn't, but
`post_form` does. I feel that changing `get` would make the situation
consistent, convenient and shouldn't impact compatibility.

I feel that discouraging the use of user & password, or of basic
authentifcation over HTTP is not the role of the standard library.
What next, a warning when we set `request.basic_auth`?

Moreover, if it was deemed important that URI didn't have a user &
password, then `get` is the wrong level to intervene.

I remark that a scheme set to 'https' is currently ignored by `get`
and `post_form`, which I believe to be erroneous, counter-intuitive
and insecure. Either I'm missing the ideology behind ignoring info
from URI, or it is simply a similar oversight as ignoring the user &
password. I believe it is related and in the right context, as
exemplified by the following line:

  Net::HTTP.get(URI("https://bob:[e-mail]"))

If `get` worked as I believe it should, the above line would work and
security would not be compromised (at least at the network level),
while currently the request is made in HTTP (on port 443) and no
credential is ever sent.