mswjs / interceptors

Low-level network interception library.
https://npm.im/@mswjs/interceptors
MIT License
537 stars 123 forks source link

fix(ClientRequest): support empty "username" and "password" basic auth values #447

Closed mikicho closed 11 months ago

mikicho commented 11 months ago

According to this test, passwords are not mandatory.

I couldn't find any specific spec for this, but I guess that if Nock has a test for it someone needed this.

mikicho commented 11 months ago

image Seems like password without a user is ok too 😅

mikicho commented 11 months ago

add a fallback to the password value to make sure it's an empty string if it's not set.

I thought about it, but isn't it the job of the normalization function?

kettanaito commented 11 months ago

@mikicho, not really. The normalization happens between the variable nature of the ClientRequest options, but we still treat the given values as-is. In this case, if the URL has been given, we will operate with its url.username and url.password values as they were provided to prevent any confusion.

Besides, this fallback value logic is necessary only in the context of the Authorization header so it belongs here.

Regarding the password being optional too, I suggest then making this check OR-OR and composing the auth string taking the optional nature of the two values into account.

if (username != null || password != null) {
  const resolvedUsername = username || ''
  const resolvedPassword = password || ''
  const auth = `${resolvedUsername}:${resolvedPassword}`
}
mikicho commented 11 months ago

@kettanaito PTAL. Feel free to update the formatting :)

kettanaito commented 11 months ago

Released: v0.25.5 🎉

This has been released in v0.25.5!

Make sure to always update to the latest version (npm i @mswjs/interceptors@latest) to get the newest features and bug fixes.


Predictable release automation by @ossjs/release.