Flowpack.ElasticSearch icon indicating copy to clipboard operation
Flowpack.ElasticSearch copied to clipboard

allow null values for username and password - libcurl problems

Open 0xC9C3 opened this issue 1 year ago • 0 comments

Currently no null values are allowed for username and password.

This leads to potentially undesired behavior when guzzle/psr7 is used as Uri builder.

See this line https://github.com/guzzle/psr7/blob/2.6/src/Uri.php#L438

Currently only strings are allowed which means any url without any auth information will be built like this:

https://:@DOMAIN.TLD/...

This is seemingly not an issue for older curl versions.

We had the case where we upgraded from libcurl 7.79.1 to 8.0.1 and our application stopped working. This is because newer curl versions respect empty Http Basic auth and still set the proper header values. In our case this prevented the communication to AWS OpenSearch, since no authentication was expected.

If like in our case no authentication should be used, valid yaml null values like null and ~ could be used to type safe set those to null.

Let me know if you need changes or more information.

0xC9C3 avatar Sep 06 '23 17:09 0xC9C3