ERR invalid password when the password contains a "+"

Environment

$ node --version
v12.11.1

$ npm --version
6.11.3

$ npm view ioredis version
4.14.1

Steps to reproduce

Consider the following test:

const connStrDb0 = "redis://[CENSORED]:6380?password=9R6ocWzNBdUK7sern0BDCC72b3rceZmqyrY+BVhD1wU=&tls=true";

let redis0;

describe("Checking possibility to use the same Redis with different DBs", () => {

  beforeEach(() => {
    redis0 = new Redis(connStrDb0);
  });

  afterEach(() => {
    redis0.disconnect();
  })

  it("should be possible to set the same key on different connections", async () => {
    await redis0.set("foo", "bar0");

    expect(await redis0.get("foo")).toEqual("bar0");
  });

And run it using DEBUG=ioredis:* jest index.test.js

Expected result

The test should pass 😃

Actual result

ioredis has an issue and sends the password with the “+” changed to a space bar - logs attached

  ioredis:redis status[CENSORED:6380]: connecting -> connect +264ms
  ioredis:redis write command[CENSORED:6380]: 0 -> auth([ '9R6ocWzNBdUK7sern0BDCC72b3rceZmqyrY BVhD1wU=' ]) +1ms
  ioredis:redis write command[CENSORED:6380]: 0 -> info([]) +1ms

[luin]

I just added two test cases to address this issue: https://github.com/luin/ioredis/commit/66920f1a25b083c9d62e820215654920be3c1052.

The correct usage for passing passwords via URL is to place it in the password part (that’s user:pass@host). For your case, I think the correct way is:

redis://:9R6ocWzNBdUK7sern0BDCC72b3rceZmqyrY+BVhD1wU@[CENSORED]:6380?&tls=true

It’s supported to pass passwords via queries, but passwords need to be encoded first:

redis://[CENSORED]:6380?password=9R6ocWzNBdUK7sern0BDCC72b3rceZmqyrY%2BBVhD1wU=&tls=true

[grisha87]

Thanks for the hint then!