feat: add redis-compatible auth and protected mode - #57
Merged
Conversation
adds Auth and Quit variants to the Command enum with full parsing support. AUTH accepts both legacy (password only) and redis 6+ (username password) forms. includes unit tests for correct parsing and arity validation.
adds --requirepass CLI flag to require AUTH before running commands. adds protected mode: rejects non-loopback connections when no password is set and the server is bound to a public address. the DENIED error is written directly to the socket before closing.
adds per-connection authentication state to both sharded and concurrent handlers. unauthenticated connections can only run AUTH, PING, ECHO, and QUIT — all other commands return NOAUTH. shared auth helpers (is_auth_frame, is_allowed_before_auth, try_auth) live in connection_common.rs. re-auth on already authenticated connections is supported.
kacy
added a commit
that referenced
this pull request
Feb 11, 2026
* feat: add AUTH and QUIT command parsing adds Auth and Quit variants to the Command enum with full parsing support. AUTH accepts both legacy (password only) and redis 6+ (username password) forms. includes unit tests for correct parsing and arity validation. * feat: add requirepass config and protected mode adds --requirepass CLI flag to require AUTH before running commands. adds protected mode: rejects non-loopback connections when no password is set and the server is bound to a public address. the DENIED error is written directly to the socket before closing. * feat: add auth gate to connection handlers adds per-connection authentication state to both sharded and concurrent handlers. unauthenticated connections can only run AUTH, PING, ECHO, and QUIT — all other commands return NOAUTH. shared auth helpers (is_auth_frame, is_allowed_before_auth, try_auth) live in connection_common.rs. re-auth on already authenticated connections is supported. * docs: update README with auth and protected mode
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
summary
--requirepassCLI flag for redis-compatible AUTH before running commandsAUTH password(legacy) andAUTH username password(redis 6+) formswhat was tested
cargo clippy --all-targetscleandesign considerations
let mut authenticated), not global — no locking on the hot pathjoin_allparallel dispatch is used unchangedconnection_common.rsto avoid duplication between handlers