Authorization header is forwarded on redirect to different host about pacote

[simonua]

Awesome! Thank you, everybody! I'll look for a new beta on Monday and give it a try, then report back. Have a great weekend, everyone!

Cheers,

Simon

[simonua]

@zkat @zarenner @ivanph, I verified I can now install private packages from VSTS Package Management with 5.0.0-beta.44 (presumably works with 43 as well, but 44 was latest available). Way to go! And, thank you!

[zarenner]

@zkat @simonua I don't think I'll likely have time today to take a deeper look at this, but I'll try to tomorrow or Monday.

[zkat]

pacote should be emulating the behavior in npm itself for this. This was intended to be handled in https://github.com/zkat/pacote/blob/latest/lib/fetchers/registry/fetch.js#L74-L78

I'm not sure why it's not working right now. I'll look into it. :)

[zkat]

It would be useful to see a pair of URLs here

[zarenner]

Thanks! FYI I don't see getHeaders getting called on the redirect.

An example:
https://zlrenner.pkgs.visualstudio.com/_packaging/aaa/npm/registry/npmtest/-/npmtest-1.0.0.tgz responds with a 302 to Location https://vsblobprodscussu0shard19.blob.core.windows.net/b-ce7824a198f144319abb2dd6dbc33de7/9D4EBD0553ED8F94889EC70CDA985199EF1284A516751904BDBB4F28192BC4B000.blob?sv=2015-12-11&sr=b&si=1&sig=redacted&spr=https&se=2017-05-05T03%3A10%3A10Z

[zkat]

ohhhhh. It's in the redirect.

It makes more sense that this would be forwarding headers like that. I wonder why request doesn't send them (we use node-fetch under the hood now, instead). I'll look into it more.

I'm assuming zlrenner.pkgs.visualstudio.com is the same host as the manifest, and that blob.core is where we shouldn't pass the creds to?

[zkat]

Aha, here's where request does it:

https://github.com/request/request/blob/b12a6245d9acdb1e13c6486d427801e123fdafae/lib/redirect.js#L134-L138

[zkat]

npm/node-fetch-npm#1 I've traced the source to node-fetch-npm itself, and pointed out where in the code it probably needs to be patched.

[zkat]

It landed. The redirect auth issue should be fixed now. Cheers to @ivanph for the patch :)