Skip to content

Deprecate BasicAuth in favor of middleware based auth #10921

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
bdraco opened this issue May 21, 2025 · 5 comments
Open

Deprecate BasicAuth in favor of middleware based auth #10921

bdraco opened this issue May 21, 2025 · 5 comments
Milestone

Comments

@bdraco
Copy link
Member

bdraco commented May 21, 2025

We can replace BasicAuth and proxy auth with a middleware helper instead so we don't have to maintain two methods. This will be a long deprecation cycle.

@bdraco bdraco added the bug label May 21, 2025
@Dreamsorcerer
Copy link
Member

Or even just ask users to set the header, which is going to more efficient. A middleware to set a header on every request to a fixed value is probably overkill (as is the existing BasicAuth implementation).

@bdraco
Copy link
Member Author

bdraco commented May 22, 2025

Or even just ask users to set the header, which is going to more efficient

While more efficient, I expect it to be beyond the skill level of many first time users

@bdraco bdraco removed the bug label May 22, 2025
@bdraco
Copy link
Member Author

bdraco commented May 22, 2025

We also need to think about the case or the username and password is embedded in the URL

@bdraco bdraco added this to the 3.13 milestone May 22, 2025
@Dreamsorcerer
Copy link
Member

Or even just ask users to set the header, which is going to more efficient

While more efficient, I expect it to be beyond the skill level of many first time users

Maybe the encoding, but we can keep a helper for that. So, already today, you could probably just do:
headers={"Authorization": BasicAuth(user, password).encode()}

@Dreamsorcerer
Copy link
Member

We also need to think about the case or the username and password is embedded in the URL

I think that's a separate thing from the auth parameter, so probably little to do there. There are tests for it anyway, so it won't be forgotten.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants