rpcclient: make HTTP Basic Auth optional via DisableAuth
What changed, and why it matters
This change adds a new optional setting called DisableAuth to the btcd RPC client. When a user turns it on, the client will not send username/password credentials automatically. This is meant to let users connect to external Bitcoin API services that use a key in the web address instead of HTTP Basic Auth. It is a feature addition, not a fix for an active security flaw. The only risk is that someone who enables it may accidentally send unauthenticated requests if they forget to configure the other security mechanism provided by their RPC provider.
Treat as a routine feature addition. If adopting DisableAuth, document that users must ensure another authentication mechanism (e.g., API key in URL, TLS client certificates, network-level access control) is in place. No urgent patching is required.
Security signals we found
New opt-in configuration flag that disables authentication headers
Default behavior unchanged; authentication still required unless user explicitly disables it
No validation added to ensure alternative authentication is present when DisableAuth is true
Potential for operator misconfiguration leading to unauthenticated requests
Evidence from the diff
The commit introduces a DisableAuth boolean field on ConnConfig in rpcclient/infrastructure.go. When true, the client skips the getAuth() call and does not set the HTTP Authorization header for both standard HTTP and websocket RPC connections. Previously, the client always sent Basic Auth or cookie auth, which broke compatibility with third-party RPC endpoints that reject Authorization headers. The change is guarded by an explicit opt-in flag and does not alter default behavior.
Changed components
rpcclient/infrastructure.goConnConfig structHTTP RPC request pathWebsocket RPC dial pathInspect captured patch +25 / −13
diff --git a/rpcclient/infrastructure.go b/rpcclient/infrastructure.go
index 2d53fcf..5d2d3b2 100644
--- a/rpcclient/infrastructure.go
+++ b/rpcclient/infrastructure.go
@@ -811,11 +811,13 @@ retryloop:
}
// Configure basic access authorization.
- user, pass, authErr := config.getAuth()
- if authErr != nil {
- return nil, authErr
+ if !config.DisableAuth {
+ user, pass, authErr := config.getAuth()
+ if authErr != nil {
+ return nil, authErr
+ }
+ httpReq.SetBasicAuth(user, pass)
}
- httpReq.SetBasicAuth(user, pass)
httpResponse, err = httpClient.Do(httpReq)
@@ -1330,6 +1332,12 @@ type ConnConfig struct {
// EnableBCInfoHacks is an option provided to enable compatibility hacks
// when connecting to blockchain.info RPC server
EnableBCInfoHacks bool
+
+ // DisableAuth instructs the client to skip setting the Authorization
+ // header on RPC requests. This is useful when connecting to third-party
+ // RPC providers that authenticate via API key in the URL path and
+ // reject requests containing an Authorization header with 401 errors.
+ DisableAuth bool
}
// getAuth returns the username and passphrase that will actually be used for
@@ -1469,16 +1477,20 @@ func dial(config *ConnConfig) (*websocket.Conn, error) {
dialer.NetDial = proxy.Dial
}
- // The RPC server requires basic authorization, so create a custom
- // request header with the Authorization header set.
- user, pass, err := config.getAuth()
- if err != nil {
- return nil, err
- }
- login := user + ":" + pass
- auth := "Basic " + base64.StdEncoding.EncodeToString([]byte(login))
+ // Configure basic access authorization. When DisableAuth is set, skip
+ // setting the Authorization header entirely. This is useful for
+ // third-party RPC providers that authenticate via API key in the URL
+ // path and reject requests containing an Authorization header.
requestHeader := make(http.Header)
- requestHeader.Add("Authorization", auth)
+ if !config.DisableAuth {
+ user, pass, err := config.getAuth()
+ if err != nil {
+ return nil, err
+ }
+ login := user + ":" + pass
+ auth := "Basic " + base64.StdEncoding.EncodeToString([]byte(login))
+ requestHeader.Add("Authorization", auth)
+ }
for key, value := range config.ExtraHeaders {
requestHeader.Add(key, value)
}
Why this scored 21/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.