decodeURIComponent basic auth - Githubissues

sindresorhus / got

🌐 Human-friendly and powerful HTTP request library for Node.js

MIT License

14.27k stars 935 forks source link

decodeURIComponent basic auth #1249

Closed stevenvachon closed 4 years ago

stevenvachon commented 4 years ago

Describe the bug

Got version: 11.1.3
- Node.js version: 12.16.3 and 14.2.0
- OS & version: macOS 10.15.4

Similar to #1234, basic auth values are not decoded before sending to http.request, resulting in authentication failure.

Code to reproduce

These send "%3Duser" and "%3Dpass" to http.request:

const url = new URL('http://host');
url.username = '=user';
url.password = '=pass';
got(new URL(url));

got({
  password: '=user',
  url: 'http://host',
  username: '=user'
});

const url = new URL('http://host');
got(`${url.protocol}//=user:=pass@${url.host}`);

Checklist

[x] I have read the documentation.
[x] I have tried my code with the latest version of Node.js and Got.

szmarczak commented 4 years ago

Duplicate of #1169