feat: add basic-auth-hash-password flag for encrypted basic auth #1066

weidongkl · 2025-11-25T02:16:52Z

Add new -basic-auth-hash-password command line flag accepting bcrypt hashes
Preserve legacy -basic-auth-password parameter for backward compatibility

fix: #976

https://prometheus.io/docs/guides/basic-auth/#hashing-a-password

plainpassword

error hash password

correct hash password

set both hash-password and password

codecov · 2025-11-25T02:34:00Z

Codecov Report

❌ Patch coverage is 72.72727% with 6 lines in your changes missing coverage. Please review.
✅ Project coverage is 81.82%. Comparing base (b0a03b2) to head (8f7399b).
⚠️ Report is 2 commits behind head on master.

Files with missing lines	Patch %	Lines
main.go	53.84%	6 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #1066      +/-   ##
==========================================
- Coverage   81.86%   81.82%   -0.05%     
==========================================
  Files          20       20              
  Lines        2636     2652      +16     
==========================================
+ Hits         2158     2170      +12     
- Misses        358      362       +4     
  Partials      120      120

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

coveralls · 2025-11-25T02:34:12Z

Pull Request Test Coverage Report for Build 19915781886

Details

19 of 27 (70.37%) changed or added relevant lines in 2 files are covered.
No unchanged relevant lines lost coverage.
Overall coverage decreased (-0.1%) to 85.643%

Changes Missing Coverage	Covered Lines	Changed/Added Lines	%
main.go	9	17	52.94%

Totals
Change from base Build 19625151374:	-0.1%
Covered Lines:	2738
Relevant Lines:	3197

💛 - Coveralls

oliver006 · 2025-11-26T06:36:11Z

Thanks for the PR!
I'll try to have a look at it over the next few days and will get back to you.

oliver006 · 2025-11-26T06:43:17Z

exporter/http.go

 	if !authHeaderSet {
 		return errors.New("Unauthorized")
 	}
+	if err := e.verifyBasicUser(user); err != nil {


nit: verifyBasicUser --> verifyBasicAuthUser ?

oliver006 · 2025-11-26T06:47:36Z

exporter/http.go

 	passCorrect := subtle.ConstantTimeCompare([]byte(password), []byte(e.options.BasicAuthPassword))

-	if userCorrect == 0 || passCorrect == 0 {
+	if passCorrect == 0 {


I think we should keep the same pattern of always comparing both username and password to avoid timing attacks.

I'd rewrite verifyBasicAuth() and check username first (store result in "userCorrect" and then the password (depending on hash or basic) and store the result in "passCorrect" - then check and return)

oliver006 · 2025-11-26T06:48:36Z

main.go

 	return nil
 }

+// validateHashPassword checks if the the hashed password is a valid bcrypt hash


oliver006 · 2025-11-26T06:50:32Z

main.go

+	}
+
+	// Validate basic auth hashed password
+	if err := validateHashPassword(*basicAuthHashPassword); err != nil {


Let's do this inside validateAuthParams() where we validate all the auth params already?

Okay, I will modify the code according to the review comments.

oliver006

Thanks, looks good. Two minor nits and then we're good to go.

oliver006 · 2025-11-30T05:37:47Z

exporter/http.go

-	passCorrect := subtle.ConstantTimeCompare([]byte(password), []byte(e.options.BasicAuthPassword))
-
-	if userCorrect == 0 || passCorrect == 0 {
+	var (


nit: can we please keep the userCorrect := style?

Thank you for the review. You're right, and I've refactored the code to use the := style for immediate assignment where possible.

The key change is with the userCorrect variable, which is now directly assigned with a boolean expression using :=.

For the passCorrect variable, the var declaration is retained because its assignment depends on a conditional branch (if/else). Using var allows us to declare the variable first and then assign its value within the respective code blocks. If we used := inside both branches, they would create new, block-scoped variables, leaving the outer passCorrect variable unused.

oliver006 · 2025-11-30T05:38:13Z

exporter/http.go

+	} else {
+		passCorrect = subtle.ConstantTimeCompare([]byte(password), []byte(e.options.BasicAuthPassword)) > 0
+	}
+	if !userCorrect || !passCorrect {


oliver006 · 2025-11-30T05:39:13Z

main.go

 }

+// validateHashPassword checks if the the hashed password is a valid bcrypt hash
+func validateHashPassword(hashPassword string) error {


nit: can we just inline this in validateAuthParams() ? it's not used anywhere.

main.go

oliver006 · 2025-12-01T06:18:42Z

main_test.go

 	}
 }
+
+func TestValidateAuthParams(t *testing.T) {


oliver006 · 2025-12-01T06:23:31Z

exporter/http.go

+
+	var passCorrect bool
+	if e.options.BasicAuthHashPassword != "" {
+		passCorrect = e.validateBasicAuthHashPassword(password)


can we add a test that makes sure we hit this line in this if block?

https://app.codecov.io/gh/oliver006/redis_exporter/pull/1066 suggests that it's not covered by tests.

maybe modify the new tests in http_test.go to use "verifyBasicAuth()" as the entry point instead of "validateBasicAuthHashPassword()"

Done! I've updated the tests in http_test.go

oliver006 · 2025-12-04T02:12:38Z

exporter/http.go

 	return nil
 }
+
+func (e *Exporter) validateBasicAuthHashPassword(hashedPassword string) bool {


one more thing: we got to rename hashedPassword to password, it's not the hashed password, the hashed password is the e.options.BasicAuthHashPassword param

You're absolutely right—what's being passed in are passwords, not hashed passwords. As for changing it to validateBasicPassword, I'd suggest putting the password validation logic directly inside this method.

e.Options... is a hashed password though, no?

e.Options... is a hashed password though, no?

Yes, it's a hashed password based on the bcrypt algorithm, consistent with the Prometheus design.

- Add new `-basic-auth-hash-password` command line flag accepting bcrypt hashes - Preserve legacy `-basic-auth-password` parameter for backward compatibility Signed-off-by: weidongkl <[email protected]>

oliver006

Thanks for your patience and for pushing this over the finish line!

weidongkl force-pushed the master branch from 5b97875 to 32dcbe2 Compare November 25, 2025 02:29

oliver006 reviewed Nov 27, 2025

View reviewed changes

weidongkl force-pushed the master branch 2 times, most recently from 8739ef6 to eea2ba6 Compare November 28, 2025 05:45

oliver006 reviewed Nov 30, 2025

View reviewed changes

weidongkl force-pushed the master branch from 3963545 to e93852b Compare December 1, 2025 02:31

oliver006 reviewed Dec 1, 2025

View reviewed changes

weidongkl force-pushed the master branch from b36ffba to 04d605e Compare December 1, 2025 08:52

oliver006 reviewed Dec 4, 2025

View reviewed changes

feat: add basic-auth-hash-password flag for encrypted basic auth

8f7399b

- Add new `-basic-auth-hash-password` command line flag accepting bcrypt hashes - Preserve legacy `-basic-auth-password` parameter for backward compatibility Signed-off-by: weidongkl <[email protected]>

weidongkl force-pushed the master branch from 2ed4128 to 8f7399b Compare December 4, 2025 02:37

oliver006 approved these changes Dec 4, 2025

View reviewed changes

oliver006 merged commit 7ad99f5 into oliver006:master Dec 4, 2025
6 of 9 checks passed

feat: add basic-auth-hash-password flag for encrypted basic auth #1066

feat: add basic-auth-hash-password flag for encrypted basic auth #1066

Uh oh!

Conversation

weidongkl commented Nov 25, 2025

Uh oh!

codecov bot commented Nov 25, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

coveralls commented Nov 25, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Pull Request Test Coverage Report for Build 19915781886

Details

💛 - Coveralls

Uh oh!

oliver006 commented Nov 26, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

oliver006 left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

oliver006 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

codecov bot commented Nov 25, 2025 •

edited

Loading

coveralls commented Nov 25, 2025 •

edited

Loading