Skip to content

cmd/go: GOAUTH credentials do not match exact URL paths with queries #80597

Description

@cuishuang

Go version

go version go1.25.6 darwin/arm64

Output of go env in your module/workspace:

AR='ar'
CC='clang'
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_ENABLED='1'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
CXX='clang++'
GCCGO='gccgo'
GO111MODULE=''
GOARCH='arm64'
GOARM64='v8.0'
GOAUTH='netrc'
GOBIN='/Users/mac/go/bin'
GOCACHE='/Users/mac/Library/Caches/go-build'
GOCACHEPROG=''
GODEBUG=''
GOENV='/Users/mac/Library/Application Support/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFIPS140='off'
GOFLAGS=''
GOGCCFLAGS=''
GOHOSTARCH='arm64'
GOHOSTOS='darwin'
GOINSECURE=''
GOMOD='/dev/null'
GOMODCACHE='/Users/mac/go/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='darwin'
GOPATH='/Users/mac/go'
GOPRIVATE=''
GOPROXY='https://goproxy.cn,direct'
GOROOT='/usr/local/go'
GOSUMDB='sum.golang.org'
GOTELEMETRY='local'
GOTELEMETRYDIR='/Users/mac/Library/Application Support/go/telemetry'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/usr/local/go/pkg/tool/darwin_arm64'
GOVCS=''
GOVERSION='go1.25.6'
GOWORK=''
PKG_CONFIG='pkg-config'

What did you do?

GOAUTH credentials can be associated with a URL path prefix. For example, a custom GOAUTH command may return credentials for:

https://example.com/api/

When loading credentials for a request whose path exactly matches that prefix but which also has a query:

https://example.com/api?version=1

the cached credential is not applied.

I added the following regression test to src/cmd/go/internal/auth/auth_test.go:

func TestCredentialCacheURLQuery(t *testing.T) {
        want := http.Request{Header: make(http.Header)}
        want.SetBasicAuth("user", "password")
        storeCredential("example.com/api", want.Header)
        got := &http.Request{Header: make(http.Header)}
        ok := loadCredential(got, "https://example.com/api?version=1")
        if !ok {
                t.Fatal("loadCredential returned false")
        }
        if !reflect.DeepEqual(got.Header, want.Header) {
                t.Fatalf("got %v, want %v", got.Header, want.Header)
        }
}

../bin/go test cmd/go/internal/auth -run '^TestCredentialCacheURLQuery$'

When using a toolchain built from the checkout, run:

$ cd src
$ ../bin/go test cmd/go/internal/auth \
    -run '^TestCredentialCacheURLQuery$' \
    -count=1 -v

Running the system go test cmd/go/internal/auth directly from the repository root does not necessarily test the checkout. It may test the package in the installed GOROOT instead, resulting in:

ok          cmd/go/internal/auth        [no tests to run]

What did you see happen?

The test fails:

--- FAIL: TestCredentialCacheURLQuery
    auth_test.go: loadCredential returned false

loadCredential walks the path hierarchy by truncating the raw URL string. It therefore tries:

example.com/api?version=1
example.com

and skips the expected example.com/api prefix.

What did you expect to see?

The test should pass. The credential stored for example.com/api should apply to https://example.com/api?version=1, because the query does not change the URL's host or path.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions