rpcclient: add tests for DisableAuth header behavior
What the developer wrote
Authored by Drake Thomsen
rpcclient: add tests for DisableAuth header behavior
Add table-driven tests that verify:
- Authorization header is omitted when DisableAuth is true
- Authorization header is present when DisableAuth is false
- Default (zero value) behavior includes Authorization header
Suggested by @TechLateef in #2514.
What changed, and why it matters
This commit only adds new unit tests for an existing feature. It does not change any production code, so it cannot introduce a security vulnerability or fix one directly. The tests verify that an existing option called DisableAuth correctly controls whether the RPC client sends an Authorization header.
No security action required. Treat as routine test-coverage improvement. If reviewing a related issue or PR, ensure the production DisableAuth logic was separately audited, but this commit itself does not alter that logic.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The commit creates rpcclient/disableauth_test.go with table-driven tests confirming that ConnConfig.DisableAuth omits the Basic Authorization header when true and includes it when false or at the default zero value. No implementation code is modified. The behavior under test already existed; this change only increases test coverage.
Changed components
rpcclient/disableauth_test.goInspect captured patch +109 / −0
diff --git a/rpcclient/disableauth_test.go b/rpcclient/disableauth_test.go
new file mode 100644
index 0000000..4ef5c28
--- /dev/null
+++ b/rpcclient/disableauth_test.go
@@ -0,0 +1,109 @@
+package rpcclient
+
+import (
+ "encoding/base64"
+ "net/http"
+ "net/http/httptest"
+ "strings"
+ "testing"
+
+ "github.com/stretchr/testify/require"
+)
+
+// TestDisableAuth verifies that the DisableAuth field correctly controls
+// whether the Authorization header is sent on RPC requests.
+func TestDisableAuth(t *testing.T) {
+ t.Parallel()
+
+ t.Run("DisableAuth true omits Authorization header", func(t *testing.T) {
+ t.Parallel()
+
+ var gotAuth string
+ srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+ gotAuth = r.Header.Get("Authorization")
+ // Return a valid JSON-RPC response so the client doesn't retry.
+ w.Header().Set("Content-Type", "application/json")
+ w.Write([]byte(`{"result":null,"error":null,"id":1}`))
+ }))
+ defer srv.Close()
+
+ addr := strings.TrimPrefix(srv.URL, "http://")
+ client, err := New(&ConnConfig{
+ Host: addr,
+ HTTPPostMode: true,
+ DisableAuth: true,
+ DisableTLS: true,
+ }, nil)
+ require.NoError(t, err)
+ defer client.Shutdown()
+
+ // The client is now connected; issue a simple request to trigger
+ // handleSendPostMessage.
+ _, err = client.RawRequest("getblockchaininfo", nil)
+ // We don't care if the RPC itself errors — we only care about
+ // the Authorization header.
+ _ = err
+
+ require.Empty(t, gotAuth, "Authorization header should be empty when DisableAuth is true")
+ })
+
+ t.Run("DisableAuth false includes Authorization header", func(t *testing.T) {
+ t.Parallel()
+
+ var gotAuth string
+ srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+ gotAuth = r.Header.Get("Authorization")
+ w.Header().Set("Content-Type", "application/json")
+ w.Write([]byte(`{"result":null,"error":null,"id":1}`))
+ }))
+ defer srv.Close()
+
+ addr := strings.TrimPrefix(srv.URL, "http://")
+ client, err := New(&ConnConfig{
+ Host: addr,
+ HTTPPostMode: true,
+ DisableAuth: false,
+ DisableTLS: true,
+ User: "testuser",
+ Pass: "testpass",
+ }, nil)
+ require.NoError(t, err)
+ defer client.Shutdown()
+
+ _, err = client.RawRequest("getblockchaininfo", nil)
+ _ = err
+
+ expected := "Basic " + base64.StdEncoding.EncodeToString([]byte("testuser:testpass"))
+ require.Equal(t, expected, gotAuth, "Authorization header should be set when DisableAuth is false")
+ })
+
+ t.Run("DisableAuth default (zero value) includes Authorization header", func(t *testing.T) {
+ t.Parallel()
+
+ var gotAuth string
+ srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+ gotAuth = r.Header.Get("Authorization")
+ w.Header().Set("Content-Type", "application/json")
+ w.Write([]byte(`{"result":null,"error":null,"id":1}`))
+ }))
+ defer srv.Close()
+
+ addr := strings.TrimPrefix(srv.URL, "http://")
+ client, err := New(&ConnConfig{
+ Host: addr,
+ HTTPPostMode: true,
+ // DisableAuth left as default (false)
+ DisableTLS: true,
+ User: "myuser",
+ Pass: "mypass",
+ }, nil)
+ require.NoError(t, err)
+ defer client.Shutdown()
+
+ _, err = client.RawRequest("getblockchaininfo", nil)
+ _ = err
+
+ expected := "Basic " + base64.StdEncoding.EncodeToString([]byte("myuser:mypass"))
+ require.Equal(t, expected, gotAuth, "Authorization header should be set by default (DisableAuth is false)")
+ })
+}
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.