axios auth does not seem to be propagated on redirect in 1.15.4+

[kevkcc]

I am seeing this issue as described in axios/axios#6179

This looks to be regression in 1.15.4 as it both workflows below work in 1.15.3. Whereas in 1.15.4+,

Basically this would return 401 after the redirect as the auth options don't seem to be propagated.

await axios.get('url_that_returns_301_and_then_redirects',
        { 
            auth: { 
                username: 'username',
                password: 'password'
            }
        });

whereas this works and returns 200:

await axios.get('url_that_redirects_and_returns_301',
        headers: {
                'Authorization': 'Basic base64_encoding_of_username_password',
            },

Through debugging, I can confirm it gets lost because the below works:

await axios.get('url_that_redirects_and_returns_301',
        { 
            auth: { 
                username: 'username',
                password: 'password'
            },
            beforeRedirect: (opts, res) => {
                 opts.auth = 'base64_encoding_of_username_password'
            }
        });

[RubenVerborgh]

That shouldn't be the case indeed!

Are you sure it's not an HTTP/HTTPS redirect issue as in #192?

[kevkcc]

Yea it shouldn't be an HTTP/HTTPS redirect issue. Both URLs for my case are HTTPS. And even so, it looks like you fixed the issue in 1.14.9 and I'm seeing a broken workflow between 1.15.3 and 1.15.4.

[ThibaudCrespin]

Hi ! Any updates on this issue ? I'm facing the same problem with both URLs in HTTPS...

[RubenVerborgh]

It's on the backlog; current funds are too limited to put a dedicated person on this. I'm trying on a best-effort basis.

[GabrielScotaEE]

I was getting the same problem with version 1.15.2 (also tryed 1.15.3 and 1.15.6) on a login request where the POST request to make the login is a redirectable request, returnin 302 status (if I disable redirects). But if the redirects are enable I'm getting a 200 responso but the login was not success.
After some time searching for what's happening, I've found that in the redirect, the session cookies was not being set, so I got a redirect to login page again. To fix it I had to disable redirects, and check for the response status, if it's on the 300 range I'm getting the response cookies, adding them on headers and finally making the redirect request.

[kevkcc]

Yes, if you manually pass in the headers, it will work as I had originally reported (tapping into axios' beforeRedirect handler). Nevertheless, that is only a workaround and this is still a clear regression happening in 1.15.4+. As 1.15.4+ fixes vulnerability CVE-2023-26159, it would be great if this could be fixed and released such that we get a version of this library with both the vulnerability fix and no serious regression.