Skip to content

fix(redis): authenticate connection when user/password are configured #87

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
breken-ai wants to merge 1 commit into from
+5 −0
Closed

fix(redis): authenticate connection when user/password are configured #87

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions src/Queue/Connection/Redis.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -202,6 +202,11 @@ protected function getRedis(): \Redis
try {
$redis->connect($this->host, $this->port, $connectTimeout);

if (!empty($this->password)) {
// ACL form when a username is configured, plain password otherwise.
$redis->auth(!empty($this->user) ? [$this->user, $this->password] : $this->password);
}
Comment on lines +205 to +208

@greptile-apps greptile-apps Bot Sep 9, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Valid credentials treated as absent

A password equal to the valid string "0" is treated as absent because PHP considers "0" empty. This skips auth(), so operations against a protected Redis instance still fail with NOAUTH. An ACL username of "0" is also misclassified, causing password-only authentication instead of ACL authentication.

Suggested change
if (!empty($this->password)) {
// ACL form when a username is configured, plain password otherwise.
$redis->auth(!empty($this->user) ? [$this->user, $this->password] : $this->password);
}
if ($this->password !== null) {
// ACL form when a username is configured, plain password otherwise.
$redis->auth($this->user !== null ? [$this->user, $this->password] : $this->password);
}
Prompt To Fix With AI 
This is a comment left during a code review.
Path: src/Queue/Connection/Redis.php
Line: 205-208

Comment:
**Valid credentials treated as absent**

A password equal to the valid string `"0"` is treated as absent because PHP considers `"0"` empty. This skips `auth()`, so operations against a protected Redis instance still fail with `NOAUTH`. An ACL username of `"0"` is also misclassified, causing password-only authentication instead of ACL authentication.

```suggestion
                if ($this->password !== null) {
                    // ACL form when a username is configured, plain password otherwise.
                    $redis->auth($this->user !== null ? [$this->user, $this->password] : $this->password);
                }
```

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Fix in Claude Code Fix in Codex


if ($this->readTimeout >= 0) {
$redis->setOption(\Redis::OPT_READ_TIMEOUT, $this->readTimeout);
}
Expand Down