How should I set _auth in .npmrc when using a Nexus https npm registry proxy?

Question

Context

My .npmrc file seems to be correctly read (checked with npm config ls -l both from command line and from Maven build).
the machine on which npm is run cannot connect directly to the net, it can only connect to a Nexus npm registry url. Therefore, proxy properties proxy and https-proxy are not set.
As access to Nexus is restricted, I have generated an access token from within Nexus.
Nexus security tokens are made from a username and a password which both contain characters such as / which usually have to be "url encoded"
as expected, with this configuration, when running npm install detects no proxy.
Nexus npm registry proxy seems to be correctly set (I can both access json files and download tgz files using a web browser after having connected using the token generated)
If I set registry to http://registry.npmjs.org/ and comment _auth, email, always-auth, strict-ssl properties, and add proxy and https-proxy configuration, npm install works as expected (but I won't be able to do it on target environment)

Content of .npmrc file

; Nexus proxy registry pointing to http://registry.npmjs.org/
registry = https://<host>/nexus/content/repositories/npmjs-registry/ 

; base64 encoded authentication token
_auth = <see question below>

; required by Nexus
email = <valid email>

; force auth to be used for GET requests
always-auth = true

; we don't want to put certificates in .npmrc
strict-ssl = false

loglevel = silly

Question

How should I generate the _auth property properly in order to have npm install work as expected?

I tried so far

base64Encode(<username>:<password>)
- results in npm info retry will retry, error on last attempt: Error: socket hang up
base64Encode(urlencode(<username>:<password>))
- results in npm info retry will retry, error on last attempt: Error: This request requires auth credentials. Run `npm login` and repeat the request.
base64Encode(urlencode(<username>):urlencode(<password>))
- results in npm info retry will retry, error on last attempt: Error: socket hang up

When getting the socket hang up error I have the following stack trace:

http request GET https://<host>/nexus/content/repositories/npmjs-registry/fsevents
sill fetchPackageMetaData Error: socket hang up
sill fetchPackageMetaData     at TLSSocket.onHangUp (_tls_wrap.js:1035:19)
sill fetchPackageMetaData     at TLSSocket.g (events.js:260:16)
sill fetchPackageMetaData     at emitNone (events.js:72:20)
sill fetchPackageMetaData     at TLSSocket.emit (events.js:166:7)
sill fetchPackageMetaData     at endReadableNT (_stream_readable.js:905:12)
sill fetchPackageMetaData     at doNTCallback2 (node.js:441:9)
sill fetchPackageMetaData     at process._tickCallback (node.js:355:17)
sill fetchPackageMetaData  error for fsevents@^1.0.0 { [Error: socket hang up] code: 'ECONNRESET' }
WARN install Couldn't install optional dependency: socket hang up
verb install Error: socket hang up
verb install     at TLSSocket.onHangUp (_tls_wrap.js:1035:19)
verb install     at TLSSocket.g (events.js:260:16)
verb install     at emitNone (events.js:72:20)
verb install     at TLSSocket.emit (events.js:166:7)
verb install     at endReadableNT (_stream_readable.js:905:12)
verb install     at doNTCallback2 (node.js:441:9)
verb install     at process._tickCallback (node.js:355:17)

When getting the This request requires auth credentials error I have the following stack trace:

npm sill fetchPackageMetaData Error: This request requires auth credentials. Run `npm login` and repeat the request.
npm sill fetchPackageMetaData     at CachingRegistryClient.authify (<root>\ui\target\node\node_modules\npm\node_modules\npm-registry-client\lib\authify.js:17:14)
npm sill fetchPackageMetaData     at CachingRegistryClient.makeRequest (<root>\ui\target\node\node_modules\npm\node_modules\npm-registry-client\lib\request.js:103:17)
npm sill fetchPackageMetaData     at <root>\ui\target\node\node_modules\npm\node_modules\npm-registry-client\lib\request.js:66:17
npm sill fetchPackageMetaData     at RetryOperation._fn (<root>\ui\target\node\node_modules\npm\node_modules\npm-registry-client\lib\attempt.js:18:5)
npm sill fetchPackageMetaData     at null._onTimeout (<root>\ui\target\node\node_modules\npm\node_modules\retry\lib\retry_operation.js:49:10)
npm sill fetchPackageMetaData     at Timer.listOnTimeout (timers.js:92:15)
npm sill fetchPackageMetaData  error for fsevents@^1.0.0 [Error: This request requires auth credentials. Run `npm login` and repeat the request.]
npm WARN install Couldn't install optional dependency: This request requires auth credentials. Run `npm login` and repeat the request.
npm verb install Error: This request requires auth credentials. Run `npm login` and repeat the request.
npm verb install     at CachingRegistryClient.authify (<root>\ui\target\node\node_modules\npm\node_modules\npm-registry-client\lib\authify.js:17:14)
npm verb install     at CachingRegistryClient.makeRequest (<root>\ui\target\node\node_modules\npm\node_modules\npm-registry-client\lib\request.js:103:17)
npm verb install     at <root>\ui\target\node\node_modules\npm\node_modules\npm-registry-client\lib\request.js:66:17
npm verb install     at RetryOperation._fn (<root>\ui\target\node\node_modules\npm\node_modules\npm-registry-client\lib\attempt.js:18:5)
npm verb install     at null._onTimeout (<root>\ui\target\node\node_modules\npm\node_modules\retry\lib\retry_operation.js:49:10)
npm verb install     at Timer.listOnTimeout (timers.js:92:15)

try to execute command `npm login` - it will ask you for credentials and updane .npmrc with _authToken section — Krzysztof Safjanowski, Jun 29 '18 at 07:13

score 72 · Answer 1 · edited Jul 20 '22 at 21:20

72

Sources: https://help.sonatype.com/repomanager3/nexus-repository-administration/formats/npm-registry/npm-security & https://help.sonatype.com/repomanager3/nexus-repository-administration/formats/npm-registry/publishing-npm-packages

Configure registry (its important doing this before configuring the authentication in step 2, because the authentication settings will be based on the registry):

npm config set registry="http://localhost:8081/repository/npm-internal/"
Configure authentication using a line like the following example:

npm config set _auth="$(echo -n 'username:password' | base64)"
Check the current configuration using the following:

npm config ls
Publish your npm package:

npm publish --registry http://localhost:8081/repository/npm-internal/

edited Jul 20 '22 at 21:20

snukone

312
3
10

answered Mar 25 '17 at 05:19

Peter Tseng

13,613
4
67
57

2

Seems that you can use just "base64" (without "openssl"). It also seems that "-n" flag is critical, since adding it to my script made it work at last – Kirill Gamazkov Jul 01 '19 at 13:14
6

dont forget about -n . Otherwsie you will get into trouble! – Witold Kaczurba Sep 27 '19 at 05:11
2

the link has changed. now it is https://help.sonatype.com/repomanager3/formats/npm-registry#npmRegistry-AuthenticationUsingBasicAuth – Matthias Wiedemann Mar 08 '21 at 14:35
3

Adding `-n` to `echo` is very important – Ali Turki Feb 21 '22 at 11:47

score 24 · Answer 2 · answered Sep 27 '19 at 09:32

If you have authorization token you should not use username:password. I suggest you:

Generate token
- Delete your ~/.npmrc or rename it.
- Make sure your env settings like $NPM_CONFIG_* are unset.
- Verify that email and other settings are unset by using: npm config list
- Log into the npm using: npm login --registry=https://nexus.whatever.registry/respository/npm-whatever-group/
- Once you are logged - you are logged. The npm should generate a token for it in your ~/.npmrc. It will look like:

//nexus.whatever.registry/respository/npm-whatever-group/:_authToken=NpmToken.YOUR-LOVELY-TOKEN-IN-HEX

You can use that token in your project, CI pipeline, and other ones. Make sure in your project .npmrc there is:

//nexus.whatever.registry/respository/npm-whatever-group/:_authToken=NpmToken.YOUR-LOVELY-TOKEN-IN-HEX email = <EMAIL_USED_FOR_TOKEN_GENERATION> always-auth = true registry = https://nexus.whatever.registry/respository/npm-whatever-group/

If you have problems with authentication/certs:
- add env variable (also to your CI/CD pipline) $NODE_EXTRA_CA_CERTS to point to /home/wherever/is/your/cert.pem
For CI/CD pipelines (like gitlabs or jenikins):
- consider replacing actual values from your .npmrc project file with ${RELEVANT_ENV_VARIABLES}. This way you will make them less visible and always self-updating on change of pipline.

Hope this help.

this should be the accepted answer but pops up as a last answer — Barlas Apaydin, Feb 16 '23 at 19:15

score 10 · Accepted Answer · answered Jan 27 '16 at 18:01

After having looked at registry-client code I found the answer, here it is. I post it as it may help other people:

base64Encode(<username>:<password>)

By the way, there is an URL encoding, but it's authify.js that takes care of it.

The "socket hang up" problem I'm facing is due to the fact that if a proxy is set in Windows configuration, when launching npm from CLI (and not from a Maven build) all ```.npmrc`` proxy settings seem to be ignored while native proxy exclusions (for corporate urls) are ignored by npm. I'll open a ticket to report this weird behavior.

How different is this answer from what you wrote in question ( " base64Encode(:) results in npm info retry will retry, error on last attempt: Error: socket hang up ") ? — Witold Kaczurba, Sep 25 '19 at 15:21

score 8 · Answer 4 · answered Jul 22 '19 at 10:44

Before you run npm login, please follow the instructions below :

1) Create an ~/.npmrc file with the following contents:

registry=https://example.com/repository/npm-group/
email=username@example.com
always-auth=true
//example.com/repository/npm-group/:_authToken=

2) run `npm login`

# npm login
Username: firstname.lastname
Password: 
Email: (this IS public) firstname.lastname@example.com
Logged in as firstname,lastname on https://example.com/repository/npm-group/.

Use the same password you use to login to example.com

score 2 · Answer 5 · answered Oct 12 '16 at 14:46

2

I don't know about Nexus, but we use artifactory as an npm repo, and there I can create my auth token by calling base64encode(username:encryptedPassword) with encryptedPassword being the one I get from my personal artifactory profile.

Maybe this helps.

answered Oct 12 '16 at 14:46

Christian Heigele

288
1
8

score 1 · Answer 6 · answered Apr 11 '23 at 20:14

1

I have my npmrc like:

registry=https://registry.npmjs.org/
@mycompany:registry=https://nexus.mycompany.ninja/repository/npm-hosted/
//nexus.mycompany.ninja/repository/npm-hosted/:_auth="this is my real auth secret="

answered Apr 11 '23 at 20:14

user1689987

1,002
1
8
23

score 0 · Answer 7 · answered Nov 02 '18 at 01:12

0

I just wrote a wrapper that stores the credentials in your systems keychain and provides them on the fly. Check out: https://github.com/Xiphe/npm_keychain_auth

answered Nov 02 '18 at 01:12

xiphe

496
6
10

How should I set _auth in .npmrc when using a Nexus https npm registry proxy?

7 Answers7

Linked