Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Ambiguity on basic auth and authorization header between instance based request and plan requests #221

Open
karloluis opened this issue Feb 25, 2025 · 0 comments
Labels
bug Something isn't working

Comments

@karloluis
Copy link

Describe the bug
The ambiguity of the docs between instance based requests and plan requests can cause confusion with regards to (basic) auth property and the Authorization header. The docs do not differentiate between request configurations and instanced based requests.

// auth indicates that HTTP Basic auth should be used, and supplies credentials.
// This will set an Authorization header, overwriting any existing
// Authorization custom headers you have set using headers.

Is it expected for Requests made using a defined instance to no be able to override the authorization header directly if the instance has a basic auth configured?

To Reproduce
Steps to reproduce the behavior:

// Plain axios request documented to prioritized `auth` field
const getWithAuthAndAuthHeader = axios.get(
  "http://example.com/",
  {
    auth: {
      username: "username",
      password: "secure password"
    },
    headers: { Authorization: "OVERWRITTEN AUTH HEADER"}
  }
)

// An axios instance with basic auth pre-configured
const instance = axios.create({
  baseURL: "http://example.com",
  auth: {
    username: "username",
    password: "secure password"
  },
})

// Uses the instance and does not warn that Authrization header will be ignored
const getWithAuthHeaderOverride = instance.get("/", {
  headers: {
    Authorization: "AMBIGUOUSLY OVERWRITTEN AUTH HEADER"
  }
})

// Uses the instance and circumvents the configured basic auth configuration
const getWithAuthHeaderOverride = instance.get("/", {
  auth: null, // explicitly bypass basic auth
  headers: {
    Authorization: "OVERWRITTEN AUTH HEADER"
  }
})
@karloluis karloluis added the bug Something isn't working label Feb 25, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

1 participant