[BUG] "npm login" does not work when registry uses ssl client authentication (mTLS)

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

Current Behavior

I'm using Verdaccio to run my own private npm registry and I have the registry behind ssl client authentication.

My .npmrc is correctly configured (npm installs do work [with cleared cache]):

registry="https://my-private-registry.com/"

//my-private-registry.com/:keyfile="/path/to/client.pkey"
//my-private-registry.com/:certfile="/path/to/client.cert"

npm notice Log in on https://my-private-registry.com/
Username: exory2024
Password:

npm error code E400
npm error 400 Bad Request - PUT https://my-private-registry.com/-/user/org.couchdb.user:exory2024/-rev/undefined
npm error A complete log of this run can be found in: /XXX.log

HTTP Status Code 400 is indicative of failed client auth. I have checked my server logs and can confirm that this particular request got denied.

I can also confirm that npm login starts to work again when I remove the ssl client auth on the server.

Stacktrace:

21 verbose stack HttpErrorGeneral: 400 Bad Request - PUT https://my-private-registry.com/-/user/org.couchdb.user:exory2024/-rev/undefined
21 verbose stack     at /usr/local/lib/node_modules/npm/node_modules/npm-registry-fetch/lib/check-response.js:103:15
21 verbose stack     at process.processTicksAndRejections (node:internal/process/task_queues:105:5)
21 verbose stack     at async putCouch (/usr/local/lib/node_modules/npm/node_modules/npm-profile/lib/index.js:133:18)
21 verbose stack     at async otplease (/usr/local/lib/node_modules/npm/lib/utils/auth.js:8:12)
21 verbose stack     at async Object.login (/usr/local/lib/node_modules/npm/lib/utils/auth.js:91:11)
21 verbose stack     at async Login.exec (/usr/local/lib/node_modules/npm/lib/commands/login.js:31:35)
21 verbose stack     at async Npm.exec (/usr/local/lib/node_modules/npm/lib/npm.js:208:9)
21 verbose stack     at async module.exports (/usr/local/lib/node_modules/npm/lib/cli/entry.js:67:5)
22 verbose statusCode 400

The bug occurs in this function.

The bug is triggered here.

I ran npm login while logging the return value of regFromURI:

npm notice Log in on https://my-private-registry.com/
URI {
  uri: 'https://my-private-registry.com/-/v1/login',
  regKey: '//my-private-registry.com/'
}
Username: exory2024
Password:
⠹URI {
  uri: 'https://my-private-registry.com/-/user/org.couchdb.user:exory2024',
  regKey: '//my-private-registry.com/'
}

⠸URI {
  uri: 'https://my-private-registry.com/-/user/org.couchdb.user:exory2024',
  regKey: '//my-private-registry.com/'
}
URI {
  uri: 'https://my-private-registry.com/-/user/org.couchdb.user:exory2024/-rev/undefined',
  regKey: false
}

As you can see the function fails to return the correct regKey for the uri https://my-private-registry.com/-/user/org.couchdb.user:exory2024/-rev/undefined'.

Expected Behavior

Successful login.

Steps To Reproduce

I suppose to recreate the bug you just have to call regFromURI with the URI above.

Environment

• npm: 11.5.1
• Node.js: 23.11.0
• OS Name: Apple Sequoia 15.5
• System Model Name: MacBook Pro M1 Max
• npm config:

; "project" config from /path/to/my/project/.npmrc

//my-private-registry.com/:certfile = (protected)
//my-private-registry.com/:keyfile = (protected)
registry = "https://my-private-registry.com/"

; node bin location = /usr/local/bin/node
; node version = v23.11.0
; npm local prefix = /path/to/my/project
; npm version = 11.5.1
; cwd = /path/to/my/project
; HOME = /Users/exory2024
; Run `npm config ls -l` to show all defaults.

Start in npm-registry-fetch/lib/auth.js at the regFromURI logic around line 83, then follow the login flow through lib/utils/auth.js and lib/commands/login.js. Reproduce the reported URI and mTLS setup, and verify that npm login derives the correct registry key and completes successfully instead of sending the failing PUT request.