Skip to content

@actions/http-client proxy auth token not properly encoded #1798

@bdehamer

Description

@bdehamer

When using the octokit client from the @actions/github library to make requests through an authenticated proxy, the user/password creds are not properly encoded in the Proxy-Authorization header.

If I have an env var like the following:

https_proxy=http://username:password@hostname:port/

And sniff the outgoing network request, I can see that the Proxy-Authorization header is set to the following:

Proxy-Authorization: username:password

The correct value should be a base64-encoded basic auth value:

Proxy-Authorization: Basic dXNlcm5hbWU6cGFzc3dvcmQ=

The issue is with the following line:

token: `${proxyUrl.username}:${proxyUrl.password}`

The token value being passed to the ProxyAgent is the un-encoded username/password pair. However, according to the documentation for the undici library (https://undici.nodejs.org/#/docs/api/ProxyAgent?id=example-basic-proxy-request-with-authentication), the supplied token needs to be pre-encoded:

token: `Basic ${Buffer.from('username:password').toString('base64')}`

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions