回复：JSON-RPC 密码
原始发布页
打开来源页面查看 1 个交叉存档
我不认为在没有 conf 文件，或配置文件不包含“rpcpassword”时，身份验证应该默认禁用；但如果其中包含“rpcpassword=”呢？
两边的道理我都明白。
如果程序员不知道如何用自己的语言（Fortran 或其他语言）实现 HTTP 身份验证，或者他们的 JSON-RPC 库根本不支持它，该怎么办？是否应该允许他们明确禁用密码要求？
反过来说，如果有一个 conf 模板文件，其中写着： rpcpassword= # 在此填写密码
有许多系统不允许你在没有密码的情况下登录。比如这个论坛。加文的观点似乎更有说服力。
顺便说一句，我还没测试过，但我希望在 conf 文件中写 rpcpassword= 是有效的。只有在使用 -server、-daemon 或 bitcoind 时，它才应该报错并给出警告。如果不需要密码，那就应该没问题。是这样吗？
英文原文
展开英文原文
I don't think authentication should be disabled by default if there's no conf file or the config file doesn't contain "rpcpassword", but what if it contains "rpcpassword="?
I can see both points.
What if the programmer can't figure out how to do HTTP authentication in their language (Fortran or whatever) or it's not even supported by their JSON-RPC library? Should they be able to explicitly disable the password requirement?
OTOH, what if there's a template conf file, with rpcpassword= # fill in a password here
There are many systems that don't allow you to log in without a password. This forum, for instance. Gavin's point seems stronger.
BTW, I haven't tested it, but I hope having rpcpassword= in the conf file is valid. It's only if you use -server or -daemon or bitcoind that it should fail with a warning. If it doesn't need the password, it should be fine. Is that right?