# Redis Without Authentication

> Detects Redis connections and configurations without authentication, allowing unauthenticated access to the cache.

- Skill: `zakirkun/redis-without-authentication` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add zakirkun/redis-without-authentication`
- Raw SKILL.md: https://api.skillmd.com/api/skills/zakirkun/redis-without-authentication/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: zakirkun (https://skillmd.com/u/zakirkun)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/zakirkun/redis-without-authentication

---


# Redis Without Authentication

## Overview
Redis instances running without authentication (`requirepass`) are exposed to unauthenticated access. Any client that can reach the Redis port can read, write, or delete all cached data — including session tokens, sensitive user data, and application secrets.

## Detection Strategy
Look for Redis client connections that do not supply a password, or Redis configuration files with `requirepass` commented out or absent.

## Remediation
- Set `requirepass <strong-password>` in `redis.conf`
- Use Redis ACL (Redis 6+) for fine-grained access control
- Bind Redis to localhost or a private network interface
- Use TLS for Redis connections in production

**Vulnerable (Node.js):**
```js
const client = redis.createClient({ host: 'redis-host', port: 6379 });
```

**Safe (Node.js):**
```js
const client = redis.createClient({ host: 'redis-host', port: 6379, password: process.env.REDIS_PASSWORD });
```