requests.post() adds unwanted Authorization: Basic header with anonymous:no@mail.dom

[temoto]

import requests
requests.post("http://localhost:9091/", data="foobar")

$ nc -l -p 9091
POST / HTTP/1.1
Host: localhost:9091
Content-Length: 6
Authorization: Basic YW5vbnltb3VzOm5vQG1haWwuZG9t
Accept-Encoding: gzip, deflate, compress
Accept: */*
User-Agent: python-requests/0.14.2 CPython/2.7.3 Linux/3.6.0-1-ARCH

foobar^C

$ base64 -d
YW5vbnltb3VzOm5vQG1haWwuZG9t
anonymous:no@mail.dom

WTF this is coming from? So after poking a bit, i found that it's from my .netrc: default login anonymous password no@mail.dom

Okay, so i have to disable automatic netrc support somehow.

Please, tell me one thing, how does it correspond to #44 where auth is explicitly set, but no header is sent and here no auth is set but header is sent?

[kennethreitz]

Interesting. I'd remove that from your .netrc immediately, fwiw :)

Also, there's a config you can set to diasble this: trust_env=False

[temoto]

Thank you. I did not touch .netrc in years, i think this line was useful for browsing public FTP.

Still it is not clear why in one case requests does not send explicitly set auth headers on premise that exact algorithm (Basic, Digest, etc) is not known beforehand. Does .netrc somehow imply Basic authorization?

[Lukasa]

If you think about the Requests API this actually makes sense. Requests special-cases Basic Auth so you can just pass a naked tuple to the auth parameter, but otherwise you need to pass a class that implements a few special methods. There's no provision for you to pass anything to the auth parameter that means "Use my .netrc file with this authentication type". Maybe there should be, but right now, if you haven't told Requests what auth type to use, it will assume you mean Basic Auth, whether you use a tuple or .netrc.

Does that answer your question?

[sigmavirus24]

@Lukasa there shouldn't be such a parameter ;)

[kennethreitz]

You shouldn't have that line in your .netrc. If it's extremely common, we can consider special-casing it.

[temoto]

@Lukasa Yes, it does, thank you for thorough answer. And i just tested, the #44 would be satisfied now that requests actually send Basic right away. Everything is consistent now.

Thank you.