-
Notifications
You must be signed in to change notification settings - Fork 1.6k
Description
When using the octokit client from the @actions/github
library to make requests through an authenticated proxy, the user/password creds are not properly encoded in the Proxy-Authorization
header.
If I have an env var like the following:
https_proxy=http://username:password@hostname:port/
And sniff the outgoing network request, I can see that the Proxy-Authorization
header is set to the following:
Proxy-Authorization: username:password
The correct value should be a base64-encoded basic auth value:
Proxy-Authorization: Basic dXNlcm5hbWU6cGFzc3dvcmQ=
The issue is with the following line:
toolkit/packages/http-client/src/index.ts
Line 729 in faf9cb2
token: `${proxyUrl.username}:${proxyUrl.password}` |
The token
value being passed to the ProxyAgent
is the un-encoded username/password pair. However, according to the documentation for the undici
library (https://undici.nodejs.org/#/docs/api/ProxyAgent?id=example-basic-proxy-request-with-authentication), the supplied token needs to be pre-encoded:
token: `Basic ${Buffer.from('username:password').toString('base64')}`