fix: poll web-login done-check on the configured registry origin#191
Merged
owlstronaut merged 2 commits intoJun 18, 2026
Merged
Conversation
manzoorwanijk
marked this pull request as ready for review
June 16, 2026 17:37
Contributor
Author
|
CC: @owlstronaut |
owlstronaut
previously approved these changes
Jun 18, 2026
Contributor
Author
|
Let me fix the test coverage |
manzoorwanijk
force-pushed
the
fix/web-login-doneurl-proxy-origin
branch
from
June 18, 2026 19:21
e968300 to
dae3cf8
Compare
manzoorwanijk
force-pushed
the
fix/web-login-doneurl-proxy-origin
branch
from
June 18, 2026 19:22
dae3cf8 to
b359585
Compare
Contributor
Author
|
@owlstronaut this fix will be backported to npm v11 when the dependency gets updated, right? |
|
@manzoorwanijk yeah we can do that |
Contributor
Author
Thanks |
owlstronaut
approved these changes
Jun 18, 2026
This was referenced Jun 18, 2026
Merged
Closed
owlstronaut
pushed a commit
that referenced
this pull request
Jun 18, 2026
owlstronaut
pushed a commit
that referenced
this pull request
Jun 18, 2026
🤖 I have created a release *beep* *boop* --- ## [13.0.1](v13.0.0...v13.0.1) (2026-06-18) ### Bug Fixes * [`3495f5f`](3495f5f) [#191](#191) poll web-login done-check on the configured registry origin (#191) (@manzoorwanijk) ### Chores * [`0ccab96`](0ccab96) [#194](#194) template-oss-apply (#194) (@owlstronaut) * [`92a1221`](92a1221) [#192](#192) bump @npmcli/template-oss from 5.1.0 to 5.1.1 (#192) (@dependabot[bot], @npm-cli-bot) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Merged
owlstronaut
pushed a commit
that referenced
this pull request
Jun 18, 2026
🤖 I have created a release *beep* *boop* --- ## [12.0.2](v12.0.1...v12.0.2) (2026-06-18) ### Bug Fixes * [`5afd320`](5afd320) poll web-login done-check on the configured registry origin (#191) (@manzoorwanijk) ### Dependencies * [`620903b`](620903b) [#196](#196) `[email protected]` ### Chores * [`2580fde`](2580fde) [#196](#196) template-oss-apply (@owlstronaut) * [`efe56aa`](efe56aa) [#196](#196) `@npmcli/[email protected]` (@owlstronaut) * [`6fe9450`](6fe9450) [#196](#196) `@npmcli/[email protected]` (@owlstronaut) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
owlstronaut
pushed a commit
to npm/cli
that referenced
this pull request
Jun 19, 2026
) Adds a regression test for #8875. The fix is in npm-profile (npm/npm-profile#191). This test is expected to be red until bundled `npm-profile` is bumped to the release with the fix, and turns green after that. ## Why `npm login --auth-type=web` silently fails behind a proxy/mirror: the returned `doneUrl` points at the canonical `registry.npmjs.org` instead of the proxy, so npm polls the wrong host, gets a `403`, and falls back to couch auth (which also fails). Fixed in npm-profile by rewriting `doneUrl` to the configured registry origin. ## How - `@npmcli/mock-registry`: `weblogin()` gains an optional `doneRegistry` to emulate a proxy advertising a `doneUrl` on another origin. - `test/lib/commands/login.js`: proxy registry whose `doneUrl` is on `registry.npmjs.org`; asserts the token is saved with no couch fallback. Fails with the current bundled npm-profile, passes once it is bumped. ## References Fixes #8875 Depends on: npm/npm-profile#191 Related: #9550
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
npm login --auth-type=web(the default) silently fails behind a proxy/mirror registry, then falls back to legacy couch auth, which also fails:This is the common proxy/mirror case: the machine (or CI) is configured to use a private registry proxy/mirror with a different origin than
registry.npmjs.org.Why
Web login does two requests against the configured registry: a
POST /-/v1/loginthat returns aloginUrl(opened in the browser) and adoneUrl(polled by npm until the token is issued).A proxy/mirror forwards npm's response verbatim, so the
doneUrlit returns points at the canonicalhttps://registry.npmjs.org/-/v1/done?..., not at the proxy that actually created the session.webAuthused thatdoneUrlas-is, so npm polledregistry.npmjs.orgdirectly and got a403(the session lives on the proxy, not on the public registry).webAuthtreats any4xx/500as "web login not supported" and falls back to couch (PUT /-/user/...), which proxies commonly reject (405/401) — the dead end users actually see.This is the login analog of npm/cli#9550: a canonical
registry.npmjs.orgURL handed back by the server must be host-rewritten to the configured registry origin before npm fetches it.How
replaceDoneUrlOrigin(doneUrl, opts.registry)rewrites thedoneUrlto the configured registry's origin before polling, preserving any registry path prefix and the query string.The session is created by the
POST /-/v1/logintoopts.registry, so the done-check must poll that same registry.The rewrite is gated on the canonical npmjs host (
done.hostname === 'registry.npmjs.org'), mirroring the conservative default of npm/cli#9550:registry.npmjs.orgdoneUrlis corrected to poll the proxy.The browser-facing
loginUrlis never rewritten.References
Fixes npm/cli#8875
Related: npm/cli#9550