URL validation fails if URL is missing user field about marshmallow

[deckar01]

I started questioning why Redis would go off spec and discovered RFC1738 was the wrong spec to refer to. Redis based their URI scheme off of the NWG's 2005 RFC3986 which supersedes the 1994 RFC1738.

https://www.iana.org/assignments/uri-schemes/prov/redis

It no longer imposes restrictions on userinfo other than character set.

https://www.rfc-editor.org/rfc/rfc3986#section-3.2.1

RFC2396 dropped the "user:password" rules and left it up to the protocol.

https://datatracker.ietf.org/doc/html/rfc2396#appendix-G.2

[sloria]

Thanks for reporting! I don't have time to dig into this right now, but would def appreciate an investigation and/or a PR from anyone who'd be so kind

[deckar01]

RFC1738 specifies that either field is optional.

A password is only optional after a user name is included.

Some or all of the parts "<user>:<password>@", ":<password>", ":<port>", and "/<url-path>" may be excluded.

password - An optional password. If present, it follows the user name separated from it by a colon.

there is no way to specify a password without specifying a user name

[sloria]

Oh good catch. So the current validation appears to be correct then. I think we can close this

[sloria]

closed by #2244