# About open-uri and ENV

**URL:** <https://www.ruby-forum.com/t/about-open-uri-and-env/49996>\
**Category:** Ruby\
**Created:** [December 11, 2005, 7:50pm UTC](https://www.ruby-forum.com/t/about-open-uri-and-env/49996 "2005-12-11T19:50:56Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![anatol](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/7ba0ec/32.png) [@anatol](https://www.ruby-forum.com/u/anatol)\
**Post date:** [December 11, 2005, 7:50pm UTC](https://www.ruby-forum.com/t/about-open-uri-and-env/49996/1 "2005-12-11T19:50:56Z")

</div>

Hi, all.

I am investigating problem with Gems and proxy authorization and I have  
question about open-uri code.  
To be precise code from OpenURI.open\_loop(uri, options) (Current version  
from CVS)

```
when :proxy
  opt_proxy = options.fetch(:proxy)
  proxy_user = nil
  proxy_pass = nil

```

proxy option mostly come from ENV and could contain information for  
basic  
authorization: username and password. Something like this  
[http://anatol:removed\_email\_address@domain.invalid:8080/](http://anatol:removed_email_address@domain.invalid:8080/)  
and right way is parse this string and put proxy\_user to anatol,  
proxy\_pass  
to pwd and proxy\_url to [http://www.proxy.com:8080/](http://www.proxy.com:8080/)

The same with code a bit below  
when true  
find\_proxy = lambda {|u| pxy = u.find\_proxy; pxy ? [pxy, nil, nil]  
:  
nil}

It should be  
when true  
find\_proxy = lambda {|u| pxy = u.find\_proxy; pxy ?  
parse\_proxy\_and\_find\_authorization\_info(pxy) : nil}

Is it logical??

---

<div class="post-metadata">

**Author:** ![anatol](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/7ba0ec/32.png) [@anatol](https://www.ruby-forum.com/u/anatol)\
**Post date:** [December 12, 2005, 3:33am UTC](https://www.ruby-forum.com/t/about-open-uri-and-env/49996/2 "2005-12-12T03:33:20Z")

</div>

In article  
[removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid),  
Anatol P. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) writes:

> proxy option mostly come from ENV and could contain information for basic  
> authorization: username and password. Something like this  
> [http://anatol:removed\_email\_address@domain.invalid:8080/](http://anatol:removed_email_address@domain.invalid:8080/)  
> and right way is parse this string and put proxy\_user to anatol, proxy\_pass  
> to pwd and proxy\_url to [http://www.proxy.com:8080/](http://www.proxy.com:8080/)

Environment variables are not appropriate place to store  
passwords since they are visible from other users.

Note that RFC 3986 deprecates “user:password” in the  
userinfo field.

| 3.2.1. User Information  
|  
| The userinfo subcomponent may consist of a user name and, optionally,  
| scheme-specific information about how to gain authorization to access  
| the resource. The user information, if present, is followed by a  
| commercial at-sign (“@”) that delimits it from the host.  
|  
| userinfo = \*( unreserved / pct-encoded / sub-delims / “:” )  
|  
| Use of the format “user:password” in the userinfo field is  
| deprecated. Applications should not render as clear text any data  
| after the first colon (“:”) character found within a userinfo  
| subcomponent unless the data after the colon is the empty string  
| (indicating no password). Applications may choose to ignore or  
| reject such data when it is received as part of a reference and  
| should reject the storage of such data in unencrypted form. The  
| passing of authentication information in clear text has proven to be  
| a security risk in almost every case where it has been used.  
|  
| Applications that render a URI for the sake of user feedback, such as  
| in graphical hypertext browsing, should render userinfo in a way that  
| is distinguished from the rest of a URI, when feasible. Such  
| rendering will assist the user in cases where the userinfo has been  
| misleadingly crafted to look like a trusted domain name  
| (Section 7.6).