原始文献 / 论坛帖 / Re: JSON-RPC password
Re: JSON-RPC password
Bitcointalk · 2010-07-23 20:39:03 UTC
我觉得如果没有 conf 文件、或配置文件里没有 "rpcpassword"，默认不该禁用认证，但如果文件里写的是 "rpcpassword=" 呢？
两边都有道理。
如果程序员搞不定他那门语言（Fortran 之类的）怎么做 HTTP 认证，或者他的 JSON-RPC 库根本不支持，该不该允许他显式禁用密码要求？
反过来说，如果有个模板 conf 文件，里面写着
rpcpassword= # fill in a password here
很多系统不允许无密码登录。比如这个论坛。Gavin 的观点似乎更有力。
顺便说，我没测试过，但希望 conf 文件里写 rpcpassword= 是合法的。只有用 -server 或 -daemon 或 bitcoind 时才应该报错警告。如果不需要密码，应该没问题。对吧？
英文原文
I don't think authentication should be disabled by default if there's no conf file or the config file doesn't contain "rpcpassword", but what if it contains "rpcpassword="?
I can see both points.
What if the programmer can't figure out how to do HTTP authentication in their language (Fortran or whatever) or it's not even supported by their JSON-RPC library? Should they be able to explicitly disable the password requirement?
OTOH, what if there's a template conf file, with
rpcpassword= # fill in a password here
There are many systems that don't allow you to log in without a password. This forum, for instance. Gavin's point seems stronger.
BTW, I haven't tested it, but I hope having rpcpassword= in the conf file is valid. It's only if you use -server or -daemon or bitcoind that it should fail with a warning. If it doesn't need the password, it should be fine. Is that right?