AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Informational 21 Bitcoin

rpcclient: make HTTP Basic Auth optional via DisableAuth

Public commit record

What the developer wrote

Authored by Drake Thomsen

86/100 · Strong
rpcclient: make HTTP Basic Auth optional via DisableAuth

Add a DisableAuth field to ConnConfig that, when set to true, skips
setting the Authorization header on RPC requests.

This enables connecting to third-party RPC providers (e.g. Alchemy,
GetBlock) that authenticate via API key in the URL path and reject
requests containing an Authorization header with 401 errors.

Previously, getAuth() unconditionally set BasicAuth or attempted
cookie auth, leaving no way to disable authentication entirely.

Fixes #2505
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference✓ Names security-relevant behavior explicitly
The short version

What changed, and why it matters

This change adds a new optional setting called DisableAuth to the btcd RPC client. When a user turns it on, the client will not send username/password credentials automatically. This is meant to let users connect to external Bitcoin API services that use a key in the web address instead of HTTP Basic Auth. It is a feature addition, not a fix for an active security flaw. The only risk is that someone who enables it may accidentally send unauthenticated requests if they forget to configure the other security mechanism provided by their RPC provider.

Recommended action

Treat as a routine feature addition. If adopting DisableAuth, document that users must ensure another authentication mechanism (e.g., API key in URL, TLS client certificates, network-level access control) is in place. No urgent patching is required.

Security signals we found

01

New opt-in configuration flag that disables authentication headers

02

Default behavior unchanged; authentication still required unless user explicitly disables it

03

No validation added to ensure alternative authentication is present when DisableAuth is true

04

Potential for operator misconfiguration leading to unauthenticated requests

Risk score

Why this scored 21/100

Our methodology →
Potential impact 2/30
Exploitability 1/25
Stealth signal 1/15
Affected reach 3/15
Confidence 9/10
Evidence quality 5/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.