How to use http.client in Node.js if there is basic authorization

Question

As per title, how do I do that?

Here is my code:

var http = require('http');

// to access this url I need to put basic auth.
var client = http.createClient(80, 'www.example.com');

var request = client.request('GET', '/', {
    'host': 'www.example.com'
});
request.end();
request.on('response', function (response) {
  console.log('STATUS: ' + response.statusCode);
  console.log('HEADERS: ' + JSON.stringify(response.headers));
  response.setEncoding('utf8');
  response.on('data', function (chunk) {
    console.log('BODY: ' + chunk);
  });
});

http.createClient is deprecated. Use 'http.request' instead. — thomas-peter
– thomas-peter, Commented Sep 7, 2012 at 10:19

Matt · Accepted Answer · 2018-01-25 07:50:25Z

314

You have to set the Authorization field in the header.

It contains the authentication type Basic in this case and the username:password combination which gets encoded in Base64:

var username = 'Test';
var password = '123';
var auth = 'Basic ' + Buffer.from(username + ':' + password).toString('base64');
// new Buffer() is deprecated from v6

// auth is: 'Basic VGVzdDoxMjM='

var header = {'Host': 'www.example.com', 'Authorization': auth};
var request = client.request('GET', '/', header);

edited Jan 25, 2018 at 7:50

Matt

4606 silver badges9 bronze badges

answered Oct 11, 2010 at 10:57

Ivo Wetzel

46.8k17 gold badges102 silver badges112 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Sujay · Accepted Answer · 2012-08-07 19:52:52Z

69

From Node.js http.request API Docs you could use something similar to

var http = require('http');

var request = http.request({'hostname': 'www.example.com',
                            'auth': 'user:password'
                           }, 
                           function (response) {
                             console.log('STATUS: ' + response.statusCode);
                             console.log('HEADERS: ' + JSON.stringify(response.headers));
                             response.setEncoding('utf8');
                             response.on('data', function (chunk) {
                               console.log('BODY: ' + chunk);
                             });
                           });
request.end();

answered Aug 7, 2012 at 19:52

Sujay

2,19623 silver badges33 bronze badges

4 Comments

David Jones Over a year ago

This is the modern-day answer.

Katie Over a year ago

Do you need to do "user:password" or "Basic user:password"?

Sujay Over a year ago

@kayvar No you don't need to prefix it with Basic.

Sujay Over a year ago

@MarceloFilho This is what I see on the docs still auth <string> Basic authentication i.e. 'user:password' to compute an Authorization header.

Hamidreza Sadegh · Accepted Answer · 2016-10-18 07:56:09Z

20

var username = "Ali";
var password = "123";
var auth = "Basic " + new Buffer(username + ":" + password).toString("base64");
var request = require('request');
var url = "http://localhost:5647/contact/session/";

request.get( {
    url : url,
    headers : {
        "Authorization" : auth
    }
  }, function(error, response, body) {
      console.log('body : ', body);
  } );

edited Oct 18, 2016 at 7:56

answered Dec 20, 2015 at 15:46

Hamidreza Sadegh

2,24633 silver badges33 bronze badges

2 Comments

Sourabh Over a year ago

Buffer() is deprecated due to security and usability issues. Please use the Buffer.alloc(), Buffer.allocUnsafe(), or Buffer.from() methods instead

THE AMAZING Over a year ago

Buffer.from(options.auth.user + ":" + options.auth.password).toString('base64')

Husky · Accepted Answer · 2011-06-22 08:26:41Z

11

An easier solution is to use the user:pass@host format directly in the URL.

Using the request library:

var request = require('request'),
    username = "john",
    password = "1234",
    url = "http://" + username + ":" + password + "@www.example.com";

request(
    {
        url : url
    },
    function (error, response, body) {
        // Do more stuff with 'body' here
    }
);

I've written a little blogpost about this as well.

answered Jun 22, 2011 at 8:26

Husky

6,2463 gold badges51 silver badges43 bronze badges

3 Comments

Les Hazlewood Over a year ago

This is not ideal advice: any logging of URLs on either the client or server side could expose password values - this is a widely known security attack vector. I strongly recommend that no-one do this. Header values are better, and not using Basic authentication - in favor of Digest authentication or OAuth 1.0a (for example) is even better. This form of identification has also been deprecated in URIs in RFC 3986.

rich remer Over a year ago

Not using Basic Auth sounds like some bad advice. Basic auth requires transport security or it is completely insecure, yes. But basic auth with transport security is way more secure that Digest authentication. And OAuth 1 is a completely different beast with completely orthogonal security issues.

nurettin Over a year ago

@LesHazlewood It is not fair to say compromised clients can expose passwords. Compromised client simply means all bets are off. However, your deprecation warning is fair.

vrtis · Accepted Answer · 2012-01-19 21:53:11Z

9

for what it's worth I'm using node.js 0.6.7 on OSX and I couldn't get 'Authorization':auth to work with our proxy, it needed to be set to 'Proxy-Authorization':auth my test code is:

var http = require("http");
var auth = 'Basic ' + new Buffer("username:password").toString('base64');
var options = {
    host: 'proxyserver',
    port: 80,
    method:"GET",
    path: 'http://www.google.com',
    headers:{
        "Proxy-Authorization": auth,
        Host: "www.google.com"
    } 
};
http.get(options, function(res) {
    console.log(res);
    res.pipe(process.stdout);
});

answered Jan 19, 2012 at 21:53

vrtis

7579 silver badges9 bronze badges

3 Comments

Maks Over a year ago

For the edification of future readers: Thats because you are authenticating with your proxy server instead of authenticating with destination webserver (google). If you had needed to authenticate with the destination server then the Authorization header would be what you want to use.

Mond Raymond Over a year ago

Yes but often you need to do both so this is a solid answer

Sourabh Over a year ago

Buffer() is deprecated due to security and usability issues. Please use the Buffer.alloc(), Buffer.allocUnsafe(), or Buffer.from() methods instead

Manish Kumar · Accepted Answer · 2015-05-08 13:40:58Z

6

var http = require("http");
var url = "http://api.example.com/api/v1/?param1=1&param2=2";

var options = {
    host: "http://api.example.com",
    port: 80,
    method: "GET",
    path: url,//I don't know for some reason i have to use full url as a path
    auth: username + ':' + password
};

http.get(options, function(rs) {
    var result = "";
    rs.on('data', function(data) {
        result += data;
    });
    rs.on('end', function() {
        console.log(result);
    });
});

answered May 8, 2015 at 13:40

Manish Kumar

5581 gold badge7 silver badges13 bronze badges

Comments

sdqali · Accepted Answer · 2012-02-22 16:48:02Z

2

I came across this recently. Which among Proxy-Authorization and Authorization headers to set depends on the server the client is talking to. If it is a Webserver, you need to set Authorization and if it a proxy, you have to set the Proxy-Authorization header

answered Feb 22, 2012 at 16:48

sdqali

2,2341 gold badge13 silver badges6 bronze badges

Comments

Xedret · Accepted Answer · 2017-10-04 17:53:36Z

2

This code works in my case, after a lot of research. You will require to install the request npm package.

var url = "http://api.example.com/api/v1/?param1=1&param2=2";
var auth = "Basic " + new Buffer(username + ":" + password).toString("base64");
exports.checkApi = function (req, res) {
    // do the GET request
    request.get({
        url: url,
        headers: {
            "Authorization": auth
        }
    }, function (error, response, body) {
        if(error)
       { console.error("Error while communication with api and ERROR is :  " + error);
       res.send(error);
    }
        console.log('body : ', body);
        res.send(body);      

    });    
}

edited Oct 4, 2017 at 17:53

Xedret

1,89118 silver badges25 bronze badges

answered Jul 18, 2017 at 20:33

Nimish goel

2,7796 gold badges31 silver badges42 bronze badges

1 Comment

Sourabh Over a year ago

Buffer() is deprecated due to security and usability issues. Please use the Buffer.alloc(), Buffer.allocUnsafe(), or Buffer.from() methods instead

Miko Chu · Accepted Answer · 2021-03-29 15:15:36Z

1

For those not using DNS and needs more depth (you can also use request instead of get by simply replacing get with request like so: http.request({ ... })):

http.get({ 
    host: '127.0.0.1',
    port: 443,
    path: '/books?author=spongebob',
    auth: 'user:p@ssword#'
 }, resp => {
    let data;

    resp.on('data', chunk => {
        data += chunk;
    });

    resp.on('end', () => console.log(data));
}).on('error', err => console.log(err));

answered Mar 29, 2021 at 15:15

Miko Chu

1,43019 silver badges27 bronze badges

Comments

Pål Thingbø · Accepted Answer · 2022-12-13 11:36:44Z

0

This is not well documented in Node.js, but you can use

require("http").get(
    {
      url: "www.example.com",
      username: "username",
      password: "mysecret",
    },
    (resp) => {
      let data;
      resp.on("data", (chunk) => (data += chunk));
      resp.on("end", () => console.log(data));
    }
  )
  .on("error", (err) => console.log(err));

Since the got pacakge inherits it's options object from http.request, username and password is also available there.

answered Dec 13, 2022 at 11:36

Pål Thingbø

1,3011 gold badge17 silver badges18 bronze badges

Collectives™ on Stack Overflow

How to use http.client in Node.js if there is basic authorization

10 Answers 10

Comments

4 Comments

2 Comments

3 Comments

3 Comments

Comments

Comments

1 Comment

Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

10 Answers 10

Comments

4 Comments

2 Comments

3 Comments

3 Comments

Comments

Comments

1 Comment

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related