GitHub user mitpjones edited a comment on the discussion: [Q/A] (Dubbo version
3.3.1) Where can I find an example of using the Auth plugin?
I have changed the provider password as follows
```
provider:
auth: true
username: admin
password: notadmin
authenticator: basic
```
the consumer is commented out as follows
```
#consumer:
#auth: true
#username: admin
#password: notadmin
```
but the call from the consumer to the provider is still successfull
```
Wed Aug 06 07:32:39 NZST 2025 Receive result ======> Hello world
```
I would expect the call to fail as I have configured the provider with auth:
true
When debugging I can see that the authenticate() method in the
org.apache.dubbo.auth.BasicAuthenticator is being called so I am sure that the
configuration parameters are being obeyed.
When debugging the BasicAuthenticator.sign() method I can see that when the
consumer has commented out the auth configuration as above that it
(incorrectly) gets and uses the providers username/password from the url (the
fact that the provider has some how exposed it's password is concerning). But
when the consumer has the auth configured it will correctly use the use the
consumers username/password.
So I think
1) the code needs to be modified so that the provider never exposes it's
username and password and
2) the BasicAuthenticator.sign() method always uses the consumers auth
configuration
GitHub link:
https://github.com/apache/dubbo/discussions/15612#discussioncomment-14010698
----
This is an automatically sent email for [email protected].
To unsubscribe, please send an email to:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
