Repository: sindresorhus/got (ts)

Issue:
Prevent usage of Basic Auth in URL
From: https://github.com/sindresorhus/got/issues/105#issuecomment-141696906

Passing Basic Auth in the URL is deprecated and not even possible anymore in Chrome and IE: http://serverfault.com/questions/371907/can-you-pass-user-pass-for-http-basic-authentication-in-url-parameters https://tools.ietf.org/html/rfc3986#section-3.2.1

In the next major version of `got` we should throw and tell the user to use the `auth` option instead.


Pull request description:
Throw on authentication in url string
Closes #106

Patch:
diff --git a/index.js b/index.js
index 6bcf4b8..c850a75 100644
--- a/index.js
+++ b/index.js
@@ -182,9 +182,17 @@ function normalizeArguments(url, opts) {
 		throw new Error('Parameter `url` must be a string or object, not ' + typeof url);
 	}
 
+	if (typeof url === 'string') {
+		url = urlLib.parse(prependHttp(url));
+
+		if (url.auth) {
+			throw new Error('Basic authentication must be done with auth option');
+		}
+	}
+
 	opts = objectAssign(
 		{protocol: 'http:', path: ''},
-		typeof url === 'string' ? urlLib.parse(prependHttp(url)) : url,
+		url,
 		opts
 	);
 


Test patch:
diff --git a/test/arguments.js b/test/arguments.js
index cad270a..7d78121 100644
--- a/test/arguments.js
+++ b/test/arguments.js
@@ -52,6 +52,13 @@ test('arguments - overrides querystring from opts', t => {
 	});
 });
 
+test('arguments - should throw with auth in url', t => {
+	t.throws(() => {
+		got(`https://test:45d3ps453@account.myservice.com/api/token`, () => {});
+	}, /Basic authentication must be done with auth option/);
+	t.end();
+});
+
 test.after('arguments - cleanup', t => {
 	s.close();
 	t.end();