Use basic/token auth when doing explicitly constructed requests

[chrisberkhout]

Use the basic/token auth configuration not just for direct requests
(e.g. get('http://www.example.com/'), but also when doing explicitly
constructed requests (e.g. get_request(...).do_request() or
request("GET", ...).do_request()).

This matches the behavior of the auth.oauth2 configuration, which applies to all requests.

It means that the choice of whether to apply basic/token auth automatically by configuration or explicitly in CEL is separate from the choice of how to construct requests in general.

Related:

• lib: add Basic Authentication to HTTP extension #19
• mito: allow use of Basic Authentication and OAuth2 in command #23
• lib: add open-ended HTTP lib configuration constructor c926ec8
• mito,lib,internal/rc: allow configuration of token authentication #97

Related in beats:

• x-pack/filebeat/input/cel: add support for digest authentication beats#36932
• x-pack/filebeat/input/cel: add support for token authentication beats#45359

[efd6]

Not LGTM.

This behaviour is intentional and this change would be a breaking change.

[chrisberkhout]

This behaviour is intentional and this change would be a breaking change.

Yeah, I probably should have opened an issue rather than a PR for the discussion, but I think the current state of some types of authentication configuration only applying to subsets of requests is confusing for the user and something that adds effort to work around.

If we're going to leave it as is, we should probably mention it in the CEL input's options documentation. I saw the auth.token options there, tried them in mito without success, then looked at mito's config parsing code and saw that they're supported before finally seeing how they're applied and the explanation in the mito documentation.

We could add an option like auth.token.requests: direct|all, but I'm not sure that's a good idea.

[efd6]

If we're going to leave it as is, we should probably mention it in the CEL input's options documentation.

If it's not there (it's not), then by all means. I'd suggest that there be some text here to indicate where it works, linking also to here where it is fully specified.

We could add an option like auth.token.requests: direct|all, but I'm not sure that's a good idea.

Knobs are bad; people use them.