fix: normalize empty auth credentials

jasonsaayman · jasonsaayman · commit 04586c5123d8 · 2026-06-11T20:09:39.000+02:00
diff --git a/lib/adapters/http.js b/lib/adapters/http.js
@@ -375,8 +375,8 @@ module.exports = function httpAdapter(config) {
     var auth = undefined;
     var configAuth = utils.hasOwnProperty(config, 'auth') ? config.auth : undefined;
     if (configAuth) {
-      var username = utils.hasOwnProperty(configAuth, 'username') ? configAuth.username : '';
-      var password = utils.hasOwnProperty(configAuth, 'password') ? configAuth.password : '';
+      var username = utils.hasOwnProperty(configAuth, 'username') ? configAuth.username || '' : '';
+      var password = utils.hasOwnProperty(configAuth, 'password') ? configAuth.password || '' : '';
       auth = username + ':' + password;
     }
 
diff --git a/lib/adapters/xhr.js b/lib/adapters/xhr.js
@@ -42,7 +42,7 @@ module.exports = function xhrAdapter(config) {
     // HTTP basic authentication
     var configAuth = utils.hasOwnProperty(config, 'auth') ? config.auth : undefined;
     if (configAuth) {
-      var username = utils.hasOwnProperty(configAuth, 'username') ? configAuth.username : '';
+      var username = utils.hasOwnProperty(configAuth, 'username') ? configAuth.username || '' : '';
       var password = utils.hasOwnProperty(configAuth, 'password') && configAuth.password
         ? unescape(encodeURIComponent(configAuth.password))
         : '';
diff --git a/test/specs/__helpers.js b/test/specs/__helpers.js
@@ -91,6 +91,22 @@ setupBasicAuthTest = function setupBasicAuthTest() {
     }, 100);
   });
 
+  it('should normalize nullish own HTTP Basic auth credentials to empty strings', function (done) {
+    axios('/foo', {
+      auth: {
+        username: undefined,
+        password: null
+      }
+    });
+
+    setTimeout(function () {
+      var request = jasmine.Ajax.requests.mostRecent();
+
+      expect(request.requestHeaders['Authorization']).toEqual('Basic Og==');
+      done();
+    }, 100);
+  });
+
   it('should accept HTTP Basic auth credentials with non-Latin1 characters in password', function (done) {
     axios('/foo', {
       auth: {
diff --git a/test/unit/adapters/http.js b/test/unit/adapters/http.js
@@ -767,6 +767,27 @@ describe("supports http with nodejs", function () {
       });
   });
 
+  it("should normalize nullish own basic auth credentials to empty strings", function (done) {
+    server = http
+      .createServer(function (req, res) {
+        res.end(req.headers.authorization);
+      })
+      .listen(4444, function () {
+        axios
+          .get("http://localhost:4444/", {
+            auth: {
+              username: undefined,
+              password: null,
+            },
+          })
+          .then(function (res) {
+            assert.equal(res.data, "Basic " + Buffer.from(":", "utf8").toString("base64"));
+            done();
+          })
+          .catch(done);
+      });
+  });
+
   it("should not use inherited basic auth credentials after config cloning", function (done) {
     Object.prototype.username = "polluted-user";
     Object.prototype.password = "polluted-pass";
