Auth lost on redirect to same host in node 6.3.1

[msakrejda]

I had some issues with redirects with axios that I'm now pretty sure are due to something in follow-redirects. Axios is currently using 0.0.7, but I upgraded my local copy to use 0.2.0 and still seeing the issue. This does not occur with node 5.12.0, but it does happen with node 6.3.1.

The crux of it seems to be that I'm hitting an endpoint in my node app that is responding with a 301, but then I get a 401 from the resulting Location.

I set DEBUG=follow-redirects but did not get any more useful info. I then added this line:

debug('making request with', options); 

right here to log every outgoing request, and then I get the following output:

6:02:30 PM web.1  |  Thu, 18 Aug 2016 01:02:30 GMT follow-redirects making request with { maxRedirects: 5,
6:02:30 PM web.1  |    protocol: 'https:',
6:02:30 PM web.1  |    hostname: 'postgres-api.heroku.com',
6:02:30 PM web.1  |    port: null,
6:02:30 PM web.1  |    path: '/client/v11/databases/dozing-patiently-6054/transfers',
6:02:30 PM web.1  |    method: 'get',
6:02:30 PM web.1  |    headers:
6:02:30 PM web.1  |     { Accept: 'application/json, text/plain, */*',
6:02:30 PM web.1  |       'User-Agent': 'herokudata' },
6:02:30 PM web.1  |    agent: undefined,
6:02:30 PM web.1  |    auth: 'maciek@heroku.com:<redacted>' }
6:02:31 PM web.1  |  Thu, 18 Aug 2016 01:02:31 GMT follow-redirects redirecting to https://postgres-api.heroku.com/client/v11/apps/ac07e31a-710c-470e-831e-e97bfc88bcd3/transfers
6:02:31 PM web.1  |  Thu, 18 Aug 2016 01:02:31 GMT follow-redirects making request with { maxRedirects: 5,
6:02:31 PM web.1  |    protocol: 'https:',
6:02:31 PM web.1  |    hostname: 'postgres-api.heroku.com',
6:02:31 PM web.1  |    port: null,
6:02:31 PM web.1  |    path: '/client/v11/apps/ac07e31a-710c-470e-831e-e97bfc88bcd3/transfers',
6:02:31 PM web.1  |    method: 'get',
6:02:31 PM web.1  |    headers:
6:02:31 PM web.1  |     { Accept: 'application/json, text/plain, */*',
6:02:31 PM web.1  |       'User-Agent': 'herokudata' },
6:02:31 PM web.1  |    agent: undefined,
6:02:31 PM web.1  |    auth: null,
6:02:31 PM web.1  |    nativeProtocol:
6:02:31 PM web.1  |     { Server: { [Function: Server] super_: [Object] },
6:02:31 PM web.1  |       createServer: [Function],
6:02:31 PM web.1  |       globalAgent:
6:02:31 PM web.1  |        Agent {
6:02:31 PM web.1  |          domain: null,
6:02:31 PM web.1  |          _events: [Object],
6:02:31 PM web.1  |          _eventsCount: 1,
6:02:31 PM web.1  |          _maxListeners: undefined,
6:02:31 PM web.1  |          defaultPort: 443,
6:02:31 PM web.1  |          protocol: 'https:',
6:02:31 PM web.1  |          options: [Object],
6:02:31 PM web.1  |          requests: {},
6:02:31 PM web.1  |          sockets: [Object],
6:02:31 PM web.1  |          freeSockets: {},
6:02:31 PM web.1  |          keepAliveMsecs: 1000,
6:02:31 PM web.1  |          keepAlive: false,
6:02:31 PM web.1  |          maxSockets: Infinity,
6:02:31 PM web.1  |          maxFreeSockets: 256,
6:02:31 PM web.1  |          maxCachedSessions: 100,
6:02:31 PM web.1  |          _sessionCache: [Object] },
6:02:31 PM web.1  |       Agent: { [Function: Agent] super_: [Object] },
6:02:31 PM web.1  |       request: [Function],
6:02:31 PM web.1  |       get: [Function] },
6:02:31 PM web.1  |    defaultRequest: [Function: defaultMakeRequest],
6:02:31 PM web.1  |    slashes: true,
6:02:31 PM web.1  |    host: 'postgres-api.heroku.com',
6:02:31 PM web.1  |    hash: null,
6:02:31 PM web.1  |    search: null,
6:02:31 PM web.1  |    query: null,
6:02:31 PM web.1  |    pathname: '/client/v11/apps/ac07e31a-710c-470e-831e-e97bfc88bcd3/transfers',
6:02:31 PM web.1  |    href: 'https://postgres-api.heroku.com/client/v11/apps/ac07e31a-710c-470e-831e-e97bfc88bcd3/transfers' }

Note that the first request has the correct auth field, but the subsequent request has auth: null. Is this a node 6 breaking change? A bug in follow-redirects? It looks like this change could be related, but as per the logs above, the host is not changing.

[msakrejda]

As far as I can tell, this is an issue in node so I've opened a ticket there, for clarification of the intended behavior if nothing else.

[msakrejda]

This is not a follow-redirects issue. Node 6.0 broke auth in same-host redirects with nodejs/node#1480 -- it has been fixed with nodejs/node#8215 .