Authorization header missing when using HTTP Basic authentication

[ozexpert]

Your document says if calling changePassword function, only server admin and the user itself can use, otherwise 400.

let say i have

var pouchDB = new PouchDB('http://adminuser:[email protected]:5984/_users')

when I call pouchDB.allDocs() I can see Authorization header Basic XXXXXX
but when calling pouchDB.changePassword() I don't see the Authorization header, thus server admin cannot update the password as well. Am i doing something wrong?

[nolanlawson]

This may be a bug. Can you provide a snippet of code to reproduce?

BTW it's generally unadvised to insert the username and password in the URL; CouchDB authentication works best with cookie-based authorization rather than HTTP Basic Authorization.

[ozexpert]

Yeah. I coded this from console..
very simple to test. So instead I just used PouchDB's put command to update password and worked.

Look at the header when changePassword() is triggered, no authorization

var pouchDB = new PouchDB('http://adminuser:[email protected]:5984/_users')
pouchDB.changePassword('yourusername', 'password').then((data) => { console.log(data); });

[nolanlawson]

Thanks, I can reproduce this bug. The problem is that we're getting a 404 due to the headers not being sent in. Same thing happens using options.auth. This is probably a bug I introduced recently when fixing things for PouchDB 5.4.x.

[nolanlawson]

BTW I'll note that the workaround for this issue is to use cookie-based authentication rather than regular HTTP authentication. Also if you tested from console, I assume you mean Node.js, which isn't officially supported by this library...?

[nolanlawson]

I don't have time to work on this right now, but anybody with the motivation and desire would just need to make sure that the ajax opts extend from the ajax opts applied to the original database, i.e. the username and password, and then add a test to capture this case.

[nolanlawson]

Took a crack at this, but it's annoying impossible to test because CouchDB doesn't have a programmatic way to enable and disable Admin Party. So to run the tests you'd need to permanently disable Admin party.

[ozexpert]

this is also happening on getSession() call. authentication header is dropped. FYI.