# Node-RED http-request node with basic auth seems to be broken in v2.1.4
**URL:** https://discourse.nodered.org/t/node-red-http-request-node-with-basic-auth-seems-to-be-broken-in-v2-1-4/56150
**Category:** General
**Tags:** http-request
**Created:** [5 January 2022 13:50 UTC](https://discourse.nodered.org/t/node-red-http-request-node-with-basic-auth-seems-to-be-broken-in-v2-1-4/56150 "2022-01-05T13:50:41Z")
**Posts on this page:** 12
**Page:** 1
### Author:  [@LeifS](https://discourse.nodered.org/u/LeifS)
#### Post date: [5 January 2022 13:50 UTC](https://discourse.nodered.org/t/node-red-http-request-node-with-basic-auth-seems-to-be-broken-in-v2-1-4/56150/1 "2022-01-05T13:50:41Z")
Hello everybody,
it seems that that basic auth is not functional in node http-request.
I use http-request to control und get status from VLC via its Webinterface.
With update from Version 1.3 to 2.1.4 my flows stoped working and debug-node shows http status 401 not authorized.
So I tried the direct URL something like
http://:secret@localhost:8080/requests/status.json
and second the „Basic Authentication“ in config of the http-request node itself.
Both do not work anymore. VLC is some kind of special, because you have set a password in order to enable the Webinterface, but user name is left blank.
The Issue could be related to issue [HTTP Request Node, Basic Authentication returns 401 error after NR2.1 upgrade · Issue #3235 · node-red/node-red · GitHub](https://github.com/node-red/node-red/issues/3235)
Thank you in advance and kind regards.
For reconstruction start a VLC with Webinterface, on a Linux System with
`cvlc -A alsa --no-dbus -I http --http-host localhost --http-port 8080 --http-password secret udp://@:1234`
And use following example-flow
```auto
[
{
"id": "5964a30c8887d9c8",
"type": "tab",
"label": "Test",
"disabled": false,
"info": "",
"env": []
},
{
"id": "d3a4f6238526c582",
"type": "inject",
"z": "5964a30c8887d9c8",
"name": "",
"props": [
{
"p": "payload"
},
{
"p": "topic",
"vt": "str"
}
],
"repeat": "",
"crontab": "",
"once": false,
"onceDelay": 0.1,
"topic": "",
"payload": "",
"payloadType": "date",
"x": 140,
"y": 120,
"wires": [
[
"8d5324ec5271d9e1"
]
]
},
{
"id": "8d5324ec5271d9e1",
"type": "http request",
"z": "5964a30c8887d9c8",
"name": "VLC Status",
"method": "GET",
"ret": "txt",
"paytoqs": "ignore",
"url": "http://localhost:8080/requests/status.json",
"tls": "",
"persist": false,
"proxy": "",
"authType": "basic",
"senderr": false,
"x": 400,
"y": 120,
"wires": [
[
"40a0d2db8a3b1448"
]
]
},
{
"id": "40a0d2db8a3b1448",
"type": "debug",
"z": "5964a30c8887d9c8",
"name": "",
"active": true,
"tosidebar": true,
"console": false,
"tostatus": false,
"complete": "true",
"targetType": "full",
"statusVal": "",
"statusType": "auto",
"x": 590,
"y": 120,
"wires": []
}
]
```
Environment
npm 8.1.2
Node-RED Version: v2.1.4
Node.js Version: v16.13.1
Host: RaspPi 3B bullseye
---
### Author:  [@hardillb](https://discourse.nodered.org/u/hardillb)
#### Post date: [5 January 2022 14:00 UTC](https://discourse.nodered.org/t/node-red-http-request-node-with-basic-auth-seems-to-be-broken-in-v2-1-4/56150/2 "2022-01-05T14:00:51Z")
Just to be clear there is no username here, just a password?
And what happens if you set a username?
---
### Author:  [@LeifS](https://discourse.nodered.org/u/LeifS)
#### Post date: [5 January 2022 14:46 UTC](https://discourse.nodered.org/t/node-red-http-request-node-with-basic-auth-seems-to-be-broken-in-v2-1-4/56150/3 "2022-01-05T14:46:20Z")
Hi,
yes a "user name" can not be specified for VLC instance, only a password
if you pass anything in the request eg 'noname' as user you always get a 401 from vlc.
---
### Author:  [@hardillb](https://discourse.nodered.org/u/hardillb)
#### Post date: [5 January 2022 15:12 UTC](https://discourse.nodered.org/t/node-red-http-request-node-with-basic-auth-seems-to-be-broken-in-v2-1-4/56150/4 "2022-01-05T15:12:00Z")
OK, the node looks to accept just a password either as a configured auth variable or in the URL. So we need to check what exactly vlc is expecting because looking at the code it is doing what I would expect it to do.
>
---
### Author:  [@LeifS](https://discourse.nodered.org/u/LeifS)
#### Post date: [5 January 2022 17:52 UTC](https://discourse.nodered.org/t/node-red-http-request-node-with-basic-auth-seems-to-be-broken-in-v2-1-4/56150/5 "2022-01-05T17:52:05Z")
I agree with you the NR code seems to be correct .
Is there something I can do? eg implement a function node which delivers more details. Or do the http request within a function node as work around
---
### Author:  [@LeifS](https://discourse.nodered.org/u/LeifS)
#### Post date: [5 January 2022 18:16 UTC](https://discourse.nodered.org/t/node-red-http-request-node-with-basic-auth-seems-to-be-broken-in-v2-1-4/56150/6 "2022-01-05T18:16:56Z")
@hardillb thanks for your investigation. it took me a step deeper
I run tcpdump for port 8080 and got the base64 string dW5kZWZpbmVkOnNlY3JldA== for the request. It decodes to undefined:secret.
I would propose at some point "this.credentials.user" should be initialized. (and same for .password)
---
### Author:  [@dceejay](https://discourse.nodered.org/u/dceejay)
#### Post date: [5 January 2022 19:13 UTC](https://discourse.nodered.org/t/node-red-http-request-node-with-basic-auth-seems-to-be-broken-in-v2-1-4/56150/7 "2022-01-05T19:13:04Z")
Can you capture one that works also ? Does the : exist on the password only one ?
---
### Author:  [@LeifS](https://discourse.nodered.org/u/LeifS)
#### Post date: [5 January 2022 19:20 UTC](https://discourse.nodered.org/t/node-red-http-request-node-with-basic-auth-seems-to-be-broken-in-v2-1-4/56150/8 "2022-01-05T19:20:14Z")
captured from a browser request
base64 OnNlY3JldA==
plain :secret
I think the delimiter : is always a part of the auth string
---
### Author:  [@dceejay](https://discourse.nodered.org/u/dceejay)
#### Post date: [5 January 2022 19:21 UTC](https://discourse.nodered.org/t/node-red-http-request-node-with-basic-auth-seems-to-be-broken-in-v2-1-4/56150/9 "2022-01-05T19:21:28Z")
So yes. We “just” need to ensure the user is “” (empty string) and not undefined
---
### Author:  [@hardillb](https://discourse.nodered.org/u/hardillb)
#### Post date: [5 January 2022 21:00 UTC](https://discourse.nodered.org/t/node-red-http-request-node-with-basic-auth-seems-to-be-broken-in-v2-1-4/56150/10 "2022-01-05T21:00:39Z")
Issue raised
>
>
> \### Current Behavior
>
> Basic Auth should base64 encode \`username:password\` but if… either is empty then \`undefined:password\` or \`username:undefined\` ends up getting encoded.
>
> \### Expected Behavior
>
> It should encode an empty string e.g. \`:password\` or \`username:\`
>
> \### Steps To Reproduce
>
> \- Tick the use Authentication checkbox
> \- Select basic auth
> \- Leave either the username or password blank
>
> Also fails is \`username:password@\` is prepended to the hostname in the URL
>
> \### Example flow
>
> \`\`\`
> \[{"id":"f80df7c4fb6a5584","type":"inject","z":"706f8b78.caf304","name":"","props":\[{"p":"payload"},{"p":"topic","vt":"str"}\],"repeat":"","crontab":"","once":false,"onceDelay":0.1,"topic":"","payload":"","payloadType":"date","x":300,"y":500,"wires":\[\["56c4fdb246ef2d5e"\]\]},{"id":"56c4fdb246ef2d5e","type":"http request","z":"706f8b78.caf304","name":"sep creds","method":"GET","ret":"txt","paytoqs":"ignore","url":"http://localhost:1880/auth","tls":"","persist":false,"proxy":"","authType":"basic","senderr":false,"x":440,"y":500,"wires":\[\["9b07e810c11fc9e8"\]\]},{"id":"9b07e810c11fc9e8","type":"debug","z":"706f8b78.caf304","name":"","active":true,"tosidebar":true,"console":false,"tostatus":false,"complete":"false","statusVal":"","statusType":"auto","x":650,"y":420,"wires":\[\]},{"id":"4047bb86ad0fb45f","type":"http in","z":"706f8b78.caf304","name":"","url":"/auth","method":"get","upload":false,"swaggerDoc":"","x":240,"y":600,"wires":\[\["408e1f651236e5c5","70dee9f832296095"\]\]},{"id":"408e1f651236e5c5","type":"http response","z":"706f8b78.caf304","name":"","statusCode":"","headers":{},"x":440,"y":560,"wires":\[\]},{"id":"4adc6a1176b21712","type":"debug","z":"706f8b78.caf304","name":"","active":true,"tosidebar":true,"console":false,"tostatus":false,"complete":"true","targetType":"full","statusVal":"","statusType":"auto","x":800,"y":640,"wires":\[\]},{"id":"d2a860adbda159bb","type":"inject","z":"706f8b78.caf304","name":"","props":\[{"p":"payload"},{"p":"topic","vt":"str"}\],"repeat":"","crontab":"","once":false,"onceDelay":0.1,"topic":"","payload":"","payloadType":"date","x":300,"y":440,"wires":\[\["3d9dc828cc280ee6"\]\]},{"id":"3d9dc828cc280ee6","type":"http request","z":"706f8b78.caf304","name":"inline creds","method":"GET","ret":"txt","paytoqs":"ignore","url":"http://:foo@localhost:1880/auth","tls":"","persist":false,"proxy":"","authType":"basic","senderr":false,"x":450,"y":440,"wires":\[\["9b07e810c11fc9e8"\]\]},{"id":"40df7def57faddde","type":"base64","z":"706f8b78.caf304","name":"","action":"","property":"payload","x":650,"y":640,"wires":\[\["4adc6a1176b21712"\]\]},{"id":"70dee9f832296095","type":"change","z":"706f8b78.caf304","name":"","rules":\[{"t":"move","p":"req.rawHeaders\[3\]","pt":"msg","to":"payload","tot":"msg"},{"t":"set","p":"payload","pt":"msg","to":"$split(payload, \\" \\")\[1\]","tot":"jsonata"}\],"action":"","property":"","from":"","to":"","reg":false,"x":440,"y":620,"wires":\[\["40df7def57faddde","7e3e5061c605dc56"\]\]},{"id":"7e3e5061c605dc56","type":"debug","z":"706f8b78.caf304","name":"","active":true,"tosidebar":true,"console":false,"tostatus":false,"complete":"false","statusVal":"","statusType":"auto","x":660,"y":580,"wires":\[\]},{"id":"b5fe1ffc04185c98","type":"inject","z":"706f8b78.caf304","name":"","props":\[{"p":"payload"},{"p":"topic","vt":"str"}\],"repeat":"","crontab":"","once":false,"onceDelay":0.1,"topic":"","payload":"","payloadType":"date","x":300,"y":380,"wires":\[\["54c7baa412cff821"\]\]},{"id":"54c7baa412cff821","type":"http request","z":"706f8b78.caf304","name":"sep creds","method":"GET","ret":"txt","paytoqs":"ignore","url":"http://localhost:1880/auth","tls":"","persist":false,"proxy":"","authType":"basic","senderr":false,"x":440,"y":380,"wires":\[\["9b07e810c11fc9e8"\]\]},{"id":"5d091b403c2d9410","type":"inject","z":"706f8b78.caf304","name":"","props":\[{"p":"payload"},{"p":"topic","vt":"str"}\],"repeat":"","crontab":"","once":false,"onceDelay":0.1,"topic":"","payload":"","payloadType":"date","x":300,"y":320,"wires":\[\["67f4d4f2cdfb2e71"\]\]},{"id":"67f4d4f2cdfb2e71","type":"http request","z":"706f8b78.caf304","name":"inline creds","method":"GET","ret":"txt","paytoqs":"ignore","url":"http://bar:@localhost:1880/auth","tls":"","persist":false,"proxy":"","authType":"","senderr":false,"x":450,"y":320,"wires":\[\["9b07e810c11fc9e8"\]\]}\]
> \`\`\`
>
>
> \### Environment
>
> \- Node-RED version: v2.1.4
> \- Node.js version: v16.13.1
> \- npm version: 8.1.2
> \- Platform/OS: Linux
> \- Browser: Firefox
Pull request to match
>
>
> fixes #3324
>
> \