Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Sign up
Appearance settings

net/http: convert URL credentials to Authorization header for js fetch #56564

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
bored-engineer wants to merge 1 commit into golang:master
base: master
Choose a base branch
Loading
from bored-engineer:patch-2

Conversation

Copy link
Contributor

@bored-engineer bored-engineer commented Nov 4, 2022

The fetch JS API will refuse to accept URLs that contain credentials:

> fetch("https://user:pass@example.com")
TypeError: Failed to execute 'fetch' on 'Window': Request cannot be constructed from a URL that includes credentials

However the non-JS http.RoundTripper does accept URLs with credentials.
By converting the credentials to an Authorization header, we can have parity.
This header is added only if Authorization header is not already set.

Copy link
Contributor

This PR (HEAD: af7b54c) has been imported to Gerrit for code review.

Please visit https://go-review.googlesource.com/c/go/+/447916 to see it.

Tip: You can toggle comments from me using the comments slash command (e.g. /comments off)
See the Wiki page for more info

Copy link
Contributor Author

For folks that cannot patch all of their http.RoundTripper instances to handle this case, you can implement a similar patch in JS by proxying all fetch invocations:

// Proxy the global 'fetch' function
// TODO: Remove after https://go-review.googlesource.com/c/go/+/447916
globalThis.fetch = new Proxy(globalThis.fetch, {
 // When the function is invoked, modify args as needed
 apply: function (fetch, thisArg, argumentsList) {
 // Extract the input and (optional) init args
 const [input, init = {}] = argumentsList;
 // Parse the input as a URL if it's not already one
 const url = input instanceof URL ? input : new URL(input, location.href);
 // If there are credentials in the URL, add to Authorization header
 if (url.password || url.username) {
 init.headers = init.headers || new Headers();
 init.headers.set(
 "Authorization",
 `Basic ${btoa(url.username + ":" + url.password)}`
 );
 url.username = "";
 url.password = "";
 }
 return fetch.call(thisArg, url, init);
 },
});

Copy link
Contributor

Message from Damien Neil:

Patch Set 1:

(1 comment)


Please don’t reply on this GitHub thread. Visit golang.org/cl/447916.
After addressing review feedback, remember to publish your drafts!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

AltStyle によって変換されたページ (->オリジナル) /