[BUG] CDN download doesn't use provided HTTP Authorization token (even if it's provided hardcoded in the URL)
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 399
- Forks
- 68
- PR merge metrics
- No merged PRs in 30d
Description
Is there an existing issue for this?
- I have searched the existing issues
Current Behavior
Authorization token is not passed to downloader, nor from the credential storage, nor from URL directly
$ npm i -S git+https://oauth2:ghp_@github.com//private_repo.git
npm http fetch GET 404 https://codeload.github.com/me/private_repo/tar.gz/hash 1294ms (cache skip)
Expected Behavior
Auth passed to downloader from credential storage
npm http fetch GET 200 https://codeload.github.com/me/private_repo/tar.gz/hash 1294ms (cache skip)
Steps To Reproduce
- Create a private repo on GitHub
- Create read only GitHub token
- $ npm i -S git+https://oauth2:ghp_@github.com//************.git
- See it missing cache, and reverting to git+ssh
Environment
- npm:9.8.1
- Node:v20.6.1
- OS:Linux
- platform:Dell XPS 13
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing the CDN downloader used for GitHub tarball requests, then inspect how credential storage and credentials embedded in the URL are passed to it. Reproduce the private-repository installation described in the issue and verify that the downloader sends the token and receives a successful 200 response instead of falling back to git+ssh.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- networking
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100