Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
@octokit/auth-unauthenticated
Advanced tools
GitHub API token authentication for browsers and Node.js
strategy for explicitly unauthenticated Octokit instances
@octokit/auth-unauthenticated
is useful for cases when an Octokit constructor has a default authentication strategy, but you require an explicitly unauthenticated instance.
One use cases is when building a GitHub App using @octokit/auth-app
and handling webhooks using @octokit/webhooks
. While all webhook events provide an installation ID in its payload, in case of the installation.deleted
event, the app can no longer create an installation access token, because the app's access has been revoked.
createUnauthenticatedAuth() options
auth()
auth.hook(request, route, options)
or auth.hook(request, options)
Browsers |
Load
|
---|---|
Node |
Install with
|
const auth = createUnauthenticatedAuth({
reason:
"Handling an installation.deleted event (The app's access has been revoked)",
});
const authentication = await auth();
// {
// type: 'unauthenticated',
// reason: 'Handling an installation.deleted event (The app's access has been revoked)'
// }
createUnauthenticatedAuth() options
The createUnauthenticatedAuth
method requires an options.reason
argument which will be used when returning an error due to a lack of authentication or when logging a warning in case of a 404
error.
Examples
createUnauthenticatedAuth({
reason:
"Handling an installation.deleted event: The app's access has been revoked from @octokit (id: 12345)",
});
auth()
The auth()
method accepts any options, but it doesn't do anything with it. That makes it a great drop-in replacement for any other authentication strategy.
name | type | description |
---|---|---|
type
|
string
|
"unauthenticated"
|
auth.hook(request, route, options)
or auth.hook(request, options)
auth.hook()
hooks directly into the request life cycle. If a mutating request is attempted to be sent (DELETE
, PATCH
, POST
, or PUT
), the request is failed immediately and returning an error that contains the reason passed to createUnauthenticatedAuth({ reason })
.
If a request fails with a 404
or due to hitting a rate/abuse limit, the returned error is amended that it might be caused due to a lack of authentication and will include the reason passed to createUnauthenticatedAuth({ reason })
.
The request
option is an instance of @octokit/request
. The route
/options
parameters are the same as for the request()
method.
auth.hook()
can be called directly to send an authenticated request
const { data } = await auth.hook(request, "GET /");
Or it can be passed as option to request()
.
const requestWithAuth = request.defaults({
request: {
hook: auth.hook,
},
});
const { data } = await requestWithAuth("GET /");
FAQs
GitHub API token authentication for browsers and Node.js
We found that @octokit/auth-unauthenticated demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.