Reading package authenticates successfully, but downloading tarball fails with 401 Unauthorized, even when authenticated.

Describe the bug

I’m facing a similar issue to #1508. Initial requests via npm install or yarn install authenticate successfully to my verdaccio registry instance, but when a tarball begins to be downloaded, the user is reported as null and the process fails, returning error: authorization required to access package <name>. Here is a log from Verdaccio of an example of the error:

 http --> 304, req: 'GET https://registry.npmjs.org/scss-bundle' (streaming)
 http --> 304, req: 'GET https://registry.npmjs.org/scss-bundle', bytes: 0/0
 http <-- 200, user: foo(103.233.22.16 via 172.17.0.1), req: 'GET /scss-bundle', bytes: 0/23509
 http --> 304, req: 'GET https://registry.npmjs.org/@fortawesome%2Ffontawesome-svg-core' (streaming)
 http --> 304, req: 'GET https://registry.npmjs.org/@fortawesome%2Ffontawesome-svg-core', bytes: 0/0
 http <-- 200, user: foo(103.233.22.16 via 172.17.0.1), req: 'GET /@fortawesome/fontawesome-svg-core', bytes: 0/37012
 http --> 304, req: 'GET https://registry.npmjs.org/@fortawesome%2Ffree-solid-svg-icons' (streaming)
 http --> 304, req: 'GET https://registry.npmjs.org/@fortawesome%2Ffree-solid-svg-icons', bytes: 0/0
...
 http <-- 200, user: foo(103.233.22.16 via 172.17.0.1), req: 'GET /globs', bytes: 0/3222
 http <-- 401, user: null(103.233.22.16 via 172.17.0.1), req: 'GET /@types/archy/-/archy-0.0.31.tgz', error: authorization required to access package @types/archy
 http --> 304, req: 'GET https://registry.npmjs.org/lodash.debounce' (streaming)
 http --> 304, req: 'GET https://registry.npmjs.org/lodash.debounce', bytes: 0/0
 http <-- 200, user: foo(103.233.22.16 via 172.17.0.1), req: 'GET /lodash.debounce', bytes: 0/3512
 http <-- 401, user: null(103.233.22.16 via 172.17.0.1), req: 'GET /globs/-/globs-0.1.4.tgz', error: authorization required to access package globs
...
 http <-- 200, user: foo(103.233.22.16 via 172.17.0.1), req: 'GET /@types/debug', bytes: 0/8652
 http <-- 200, user: foo(103.233.22.16 via 172.17.0.1), req: 'GET /@types/fs-extra', bytes: 0/13122
 http <-- 401, user: null(103.233.22.16 via 172.17.0.1), req: 'GET /lodash.debounce/-/lodash.debounce-4.0.8.tgz', error: authorization required to access package lodash.debounce
 http <-- 200, user: foo(103.233.22.16 via 172.17.0.1), req: 'GET /pretty-bytes', bytes: 0/7403
 http <-- 200, user: foo(103.233.22.16 via 172.17.0.1), req: 'GET /chokidar', bytes: 0/30222
...
 http <-- 200, user: foo(103.233.22.16 via 172.17.0.1), req: 'GET /sass', bytes: 0/55808
 http <-- 401, user: null(103.233.22.16 via 172.17.0.1), req: 'GET /archy/-/archy-1.0.0.tgz', error: authorization required to access package archy
...

You can see how the authorised user is listed as flicking between “foo” and “null” if a tgz request is made.

To Reproduce

Steps to reproduce the behavior:

1. Login to verdaccio registry with npm login, enter username, password, and email.
2. Run npm install or yarn install.
3. NPM & Yarn fail with their respective ‘Authorization failed’ errors.

Expected behavior

Installation completes successfully.

Docker || Kubernetes (please complete the following information):

• Docker verdaccio tag verdaccio:latest
• Docker commands V_PATH=~/verdaccio; docker run --rm -d --name verdaccio -p 4873:4873 -v $V_PATH/conf:/verdaccio/conf -v npmstorage:/verdaccio/storage -v $V_PATH/plugins:/verdaccio/plugins verdaccio/verdaccio
• Docker Version Docker version 19.03.1, build 74b1e89

Configuration File (cat ~/.config/verdaccio/config.yaml)

web:
  enable: true
  title: Verdaccio
  logo: logo.png
storage: ./../storage

auth:
  htpasswd:
    file: ./htpasswd

uplinks:
  npmjs:
    url: https://registry.npmjs.org/
packages:
  '@*/*':
    access: $authenticated
    publish: $authenticated
    proxy: npmjs
  '**':
    access: $authenticated
    publish: $authenticated
    proxy: npmjs
logs:
    -  { type: stdout, format: pretty, level: http }

Environment information

Server

• Verdaccio 4.3.3 in Docker container with env described above.

Client

• macOS 10.15 Catalina
• npm 6.11.3
• yarn 1.19.1

[jeffrson]

Had the same problem - fixed it with always-auth.

[juanpicado]

hi @lukeify

http <-- 401, user: null(

means that yarn is not sending the token or _authToken. All request are independent each other, thus if you see a null means the request is anonymous and according your config should be rejected with 401. I’d try with other tools as npm using npm install -ddd to see more in detail, I think yarn has verbose mode as well.