Redact Basic Auth

1.0.1 · active · verified Wed Apr 22

redact-basic-auth is a focused utility designed to remove or obscure basic authentication credentials from URLs. This is crucial for logging, debugging, or displaying URLs where sensitive information like usernames and passwords should not be exposed. The package is currently at version 1.0.1, indicating a stable and mature, albeit simple, implementation. Its release cadence is likely very slow, as its functionality is narrowly defined and unlikely to require frequent updates. Key differentiators include its singular focus and minimal API, making it easy to integrate without pulling in larger URL parsing libraries when only basic auth redaction is needed. It operates on string manipulation rather than full URL parsing objects, providing a lightweight solution for specific security and privacy concerns in applications that handle URLs.

Common errors

```
TypeError: redact is not a function
```
cause Incorrect import statement when using ES Modules. The package uses a CommonJS default export.

fix Change `import { redact } from 'redact-basic-auth';` to `import redact from 'redact-basic-auth';`.
```
My URL is not redacting the basic auth part.
```
cause The URL string provided does not contain a 'username:password@' segment, or the segment is malformed and not recognized by the internal regex.

fix Ensure the URL strictly follows the basic auth format (e.g., `protocol://username:password@host/path`). The package does not handle credentials in query parameters or other non-standard locations.

Warnings

gotcha The package specifically targets the `username:password@` pattern typical of HTTP/FTP basic authentication in URLs. It will not redact credentials stored in query parameters, custom headers, or other parts of a URL that don't conform to this format.
Fix: For more complex redaction scenarios, consider using a full URL parsing library and performing custom string replacements or object manipulations.
gotcha The redaction is string-based using regular expressions. While robust for standard formats, malformed or highly unconventional URL structures might not be accurately processed, potentially redacting too much or too little.
Fix: Always test with a diverse set of URLs, especially edge cases, to ensure the desired redaction behavior.

Install

npm install redact-basic-auth npm
yarn add redact-basic-auth yarn
pnpm add redact-basic-auth pnpm

Imports

redact
wrong:
```
import { redact } from 'redact-basic-auth';
```
correct:
```
const redact = require('redact-basic-auth');
```
The package primarily uses CommonJS `module.exports = function(...)`. For ES Modules, it's typically imported as a default export.
redact
wrong:
```
import { redact } from 'redact-basic-auth';
```
correct:
```
import redact from 'redact-basic-auth';
```
When using ES Modules, `redact-basic-auth` exports its main function as a default export.

Quickstart

Demonstrates basic authentication redaction for various URL formats, including those with and without credentials, and how to use it with Node.js URL objects.

import redact from 'redact-basic-auth';

// Example 1: Redacting a URL with basic authentication
const urlWithAuth = 'http://myuser:mypassword@example.com/api/data?param=value';
const redactedUrl = redact(urlWithAuth);
console.log('Original URL:', urlWithAuth);
console.log('Redacted URL:', redactedUrl);
// Expected: Original URL: http://myuser:mypassword@example.com/api/data?param=value
// Expected: Redacted URL: http://myuser:redacted@example.com/api/data?param=value

// Example 2: A URL without basic authentication remains unchanged
const urlWithoutAuth = 'https://www.google.com/search?q=redact-basic-auth';
const unchangedUrl = redact(urlWithoutAuth);
console.log('Original URL (no auth):', urlWithoutAuth);
console.log('Unchanged URL:', unchangedUrl);
// Expected: Original URL (no auth): https://www.google.com/search?q=redact-basic-auth
// Expected: Unchanged URL: https://www.google.com/search?q=redact-basic-auth

// Example 3: Using with a Node.js URL object (convert to string first)
import { URL } from 'url';
const complexUrl = new URL('ftp://anonymous:secret@ftp.example.org/files/doc.txt');
const redactedComplexUrl = redact(complexUrl.toString());
console.log('Original complex URL:', complexUrl.toString());
console.log('Redacted complex URL:', redactedComplexUrl);

view raw JSON →