redis-rb: 4.5.0 breaks uri's with username/password

Hi,

I haven’t had time to fully debug this, but noticed that uri’s with username/password seem broken in the 4.5.0 version.

Steps I ran to repro

> Redis.new(url: 'redis://someuser:somepassword@a.redis.server.example.com:1234').info
Traceback (most recent call last):
        1: from (irb):20
Redis::CommandError (WRONGPASS invalid username-password pair)

I can connect with the same url using redis-cli

> redis-cli -u redis://someuser:somepassword@a.redis.server.example.com:1234
Warning: Using a password with '-a' or '-u' option on the command line interface may not be safe.
a.redis.server.example.com:1234>

I can try to provide more info if needed. Thanks!

About this issue

Original URL
State: closed
Created 3 years ago
Comments: 20 (3 by maintainers)

Most upvoted comments

4.5.1 is out https://rubygems.org/gems/redis/versions/4.5.1

byroot on Oct 15, 2021

PR is here: https://github.com/redis/redis-rb/pull/1041

I have to go away from my keyboard for a bit, but I’ll cut a 4.5.1 as soon as I can assuming CI is green (couple hours max).

casperisfine on Oct 15, 2021

Yeah, I’m pretty sure that’s it. I can connect if I leave off the username.

Ah, so the password is valid, but the username doesn’t correspond to anything? That’s what you mean? I suppose you get this URL form some kind of redis as a service?

Correct. I think our rediscloud URL was probably initially generated back when we were on heroku, which generates a URL with rediscloud as the username: https://devcenter.heroku.com/articles/rediscloud#getting-started But the actual instance is configured to use the default user. Because username was not passed to auth prior to the ACL changes, the URL worked fine until the change to restrict catching only one specific CommandError was released.

allisonphillips on Oct 15, 2021

other people might also be bitten by this

Yeah, I’ll see if I can cut a release which restore the behavior but emit some kind of warning.

casperisfine on Oct 15, 2021

Yeah, I’m pretty sure that’s it. I can connect if I leave off the username.

kirbycool on Oct 15, 2021