Skip to content

[BUG] npm config removes _auth from .npmrc #2300

Closed
Closed
[BUG] npm config removes _auth from .npmrc#2300
Assignees
isaacs
Labels
Bugthing that needs fixingRelease 7.xwork is associated with a specific npm 7 release

Description

@bradbeck
bradbeck
opened on Dec 8, 2020

Current Behavior:

npm config set <anykey> <anyvalue> will result in _auth=... being removed from .npmrc

Expected Behavior:

npm config set foo bar should not result in _auth=... being removed from .npmrc

Steps To Reproduce:

  1. echo '_auth="xxx"' >> ~/.npmrc
  2. cat ~/.npmrc to see _auth="xxx" is there
  3. npm config set foo bar
  4. cat ~/.npmrc to see _auth="xxx" is gone

Environment:

Docker image node:15.3.0
Node: 15.3.0
npm: 7.0.14

Activity

  1. bradbeck
    added
    Bugthing that needs fixing
    Needs Triageneeds review for next steps
    Release 7.xwork is associated with a specific npm 7 release
    on Dec 8, 2020

  2. ljharb commented on Dec 8, 2020

    @ljharb
    ljharb
    on Dec 8, 2020
    Contributor

    Does it still happen with v7.0.15?

  3. bradbeck commented on Dec 8, 2020

    @bradbeck
    bradbeck
    on Dec 8, 2020
    Author

    Not sure, I haven't found a way to update npm in the node docker image.

  4. ljharb commented on Dec 8, 2020

    @ljharb
    ljharb
    on Dec 8, 2020
    Contributor

    npm install -g npm@7?

  5. bradbeck commented on Dec 8, 2020

    @bradbeck
    bradbeck
    on Dec 8, 2020
    Author

    The node docker image fails to update npm that way. Some permissions issue.

    I have confirmed that it still happens for npm@7.0.15 on MacOS.

  6. isaacs commented on Dec 10, 2020

    @isaacs
    isaacs
    on Dec 10, 2020
    Contributor

    This is happening because xxx is not a valid _auth field.

    In order for credentials to be saved, a username, email address, and password must all be set, and it is re-saved to the config file scoped only to the proper registry.

    This works as expected, for example:

    $ echo $'_auth=dXNlcjpwYXNz\nemail=i@izs.me' > foo.npmrc; node . config set foo=bar --userconfig=foo.npmrc ; cat foo.npmrc
foo=bar
//registry.npmjs.org/:username=user
//registry.npmjs.org/:_password="cGFzcw=="
//registry.npmjs.org/:email=i@izs.me
//registry.npmjs.org/:always-auth=false

  7. isaacs commented on Dec 11, 2020

    @isaacs
    isaacs
    on Dec 11, 2020
    Contributor

    Note that _auth must be a base64-encoded username:password pair. It's then saved with the username and password as shown.

  8. bradbeck commented on Dec 11, 2020

    @bradbeck
    bradbeck
    on Dec 11, 2020
    Author

    @isaacs This appears to be a change in behavior relative to versions prior to npm v7. Is the methodology you describe backward compatible? If so, how far back?

  9. bradbeck commented on Dec 11, 2020

    @bradbeck
    bradbeck
    on Dec 11, 2020
    Author

    @isaacs The methodology you describe does not seem to work for ~/.npmrc and npm config set foo=bar. _auth still gets removed but it not replaced with username and password as you describe.

  10. bradbeck commented on Dec 11, 2020

    @bradbeck
    bradbeck
    on Dec 11, 2020
    Author

    In versions prior to npm v7 we used to be able to use the following to configure authentication:

    $ npm config set registry http://npm.example.com/
$ npm config set always-auth true
$ npm config set email my@example.com
$ npm config set _auth YWRtaW46YWRtaW4=

    With npm v7+ it does not appear to be possible to use npm config set ... to set email or _auth. A sequence like the following is required to get authentication working:

    $ npm config set registry http://npm.example.com/
$ echo 'email=my@example.com\n_auth="YWRtaW46YWRtaW4="' >> ~/.npmrc
$ npm config set always-auth true

    or

    $ npm config set registry http://npm.example.com/
$ npm config set //npm.example.com/:always-auth true
$ npm config set //npm.example.com/:email my@example.com
$ npm config set //npm.example.com/:username admin
$ npm config set //npm.example.com/:_password YWRtaW4=

  11. isaacs commented on Dec 15, 2020

    @isaacs
    isaacs
    on Dec 15, 2020
    Contributor

    Aha, seems like the issue here is that npm config set email my@example.com is failing, that's the bug here. Email should be able to be set separate from credentials. This works in the meantime:

    npm config set registry http://npm.example.com/
npm config set always-auth true
echo "email=my@example.com" >> ~/.npmrc
npm config set _auth YWRtaW46YWRtaW4=
  12. isaacs
    closed this as completedin 9bf2ef5on Dec 15, 2020
  13. isaacs
    reopened this on Dec 15, 2020

  14. isaacs commented on Dec 15, 2020

    @isaacs
    isaacs
    on Dec 15, 2020
    Contributor

    Will be fixed on next npm release, with @npmcli/config@1.2.8

  15. isaacs
    self-assigned this
    on Dec 15, 2020
  16. isaacs
    added
    Release-Next
    and removed
    Needs Triageneeds review for next steps
    on Dec 15, 2020
  17. isaacs
    added 3 commits that reference this issue on Dec 16, 2020

    Support multiple set/get/deletes in npm config

    4faf5f3

    Support multiple set/get/deletes in npm config

    8ccbdf2

    Support multiple set/get/deletes in npm config

    8fd006a

  18. isaacs commented on Dec 16, 2020

    @isaacs
    isaacs
    on Dec 16, 2020
    Contributor

    So, just to clarify:

    • npm config set _auth=xxx will fail if email is not set.
    • npm config set email=x@y.com will work, even if _auth is not set.
    • npm config set email=x@y.com _auth=xxx will always work (ie, adding two configs in one command).
    • in all cases, the authentication settings will still be scoped to a given registry, so it's important to either set that registry config first, or include it in the command cli config, like npm config --registry=https://npm.internal/ set email=x@y.com _auth=xxx
  19. isaacs
    added 2 commits that reference this issue on Dec 18, 2020

    Support multiple set/get/deletes in npm config

    a9b8bf2

    @npmcli/config@1.2.8

    4fc2f3e
  20. isaacs
    closed this as completedon Dec 18, 2020

  21. belun commented on Oct 18, 2022

    @belun
    belun
    on Oct 18, 2022

    still happening in npm8

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

Bugthing that needs fixingRelease 7.xwork is associated with a specific npm 7 release

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions