mirror of
https://github.com/hanzo-ds/go.git
synced 2026-10-30 19:45:01 +00:00
zeekay
057c09c529
The server reads X-Datastore-User/-Key/-SSL-Certificate-Auth verbatim and defines no alias for the upstream vendor spelling, so the TLS branch of applyOptionsToRequest could not authenticate at all: the server ignored the headers, fell back to the default user and answered 401. Only the TLS branch was affected. The plaintext branch sets req.URL.User, which net/http sends as HTTP Basic, and Basic authenticates fine — which is why every current consumer works and this stayed latent. A DSN with scheme https or secure=true routes into the broken branch. The three names are now declared once in headers.go, and covered by tests that exercise the branch over a real TLS round trip. Also reports ClientName as datastore-go; it is a self-reported label that lands in system.query_log, and nothing filters on its value.
17 lines
667 B
Go
17 lines
667 B
Go
package datastore
|
|
|
|
// Wire header names understood by the Datastore HTTP interface.
|
|
//
|
|
// The server reads these verbatim and provides no aliases, so a client that
|
|
// sends any other spelling cannot authenticate over HTTP. They are declared
|
|
// here once so the wire contract has a single definition.
|
|
const (
|
|
// HeaderUser carries the username on the HTTP interface.
|
|
HeaderUser = "X-Datastore-User"
|
|
// HeaderKey carries the password on the HTTP interface.
|
|
HeaderKey = "X-Datastore-Key"
|
|
// HeaderSSLCertificateAuth selects certificate authentication ("on") over
|
|
// password authentication ("off").
|
|
HeaderSSLCertificateAuth = "X-Datastore-SSL-Certificate-Auth"
|
|
)
|