Skip to content

cmd/go: GOAUTH credentials do not match exact URL paths with queries #80597

Description

@cuishuang

Go version

go version go1.25.6 darwin/arm64

Output of go env in your module/workspace:

AR='ar'
CC='clang'
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_ENABLED='1'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
CXX='clang++'
GCCGO='gccgo'
GO111MODULE=''
GOARCH='arm64'
GOARM64='v8.0'
GOAUTH='netrc'
GOBIN='/Users/mac/go/bin'
GOCACHE='/Users/mac/Library/Caches/go-build'
GOCACHEPROG=''
GODEBUG=''
GOENV='/Users/mac/Library/Application Support/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFIPS140='off'
GOFLAGS=''
GOGCCFLAGS=''
GOHOSTARCH='arm64'
GOHOSTOS='darwin'
GOINSECURE=''
GOMOD='/dev/null'
GOMODCACHE='/Users/mac/go/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='darwin'
GOPATH='/Users/mac/go'
GOPRIVATE=''
GOPROXY='https://goproxy.cn,direct'
GOROOT='/usr/local/go'
GOSUMDB='sum.golang.org'
GOTELEMETRY='local'
GOTELEMETRYDIR='/Users/mac/Library/Application Support/go/telemetry'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/usr/local/go/pkg/tool/darwin_arm64'
GOVCS=''
GOVERSION='go1.25.6'
GOWORK=''
PKG_CONFIG='pkg-config'

What did you do?

GOAUTH credentials can be associated with a URL path prefix. For example, a custom GOAUTH command may return credentials for:

https://example.com/api/

When loading credentials for a request whose path exactly matches that prefix but which also has a query:

https://example.com/api?version=1

the cached credential is not applied.

I added the following regression test to src/cmd/go/internal/auth/auth_test.go:

func TestCredentialCacheURLQuery(t *testing.T) {
        want := http.Request{Header: make(http.Header)}
        want.SetBasicAuth("user", "password")
        storeCredential("example.com/api", want.Header)
        got := &http.Request{Header: make(http.Header)}
        ok := loadCredential(got, "https://example.com/api?version=1")
        if !ok {
                t.Fatal("loadCredential returned false")
        }
        if !reflect.DeepEqual(got.Header, want.Header) {
                t.Fatalf("got %v, want %v", got.Header, want.Header)
        }
}

../bin/go test cmd/go/internal/auth -run '^TestCredentialCacheURLQuery$'

When using a toolchain built from the checkout, run:

$ cd src
$ ../bin/go test cmd/go/internal/auth \
    -run '^TestCredentialCacheURLQuery$' \
    -count=1 -v

Running the system go test cmd/go/internal/auth directly from the repository root does not necessarily test the checkout. It may test the package in the installed GOROOT instead, resulting in:

ok          cmd/go/internal/auth        [no tests to run]

What did you see happen?

The test fails:

--- FAIL: TestCredentialCacheURLQuery
    auth_test.go: loadCredential returned false

loadCredential walks the path hierarchy by truncating the raw URL string. It therefore tries:

example.com/api?version=1
example.com

and skips the expected example.com/api prefix.

What did you expect to see?

The test should pass. The credential stored for example.com/api should apply to https://example.com/api?version=1, because the query does not change the URL's host or path.

Metadata

Metadata

Assignees

No one assigned

    Labels

    GoCommandcmd/goNeedsFixThe path to resolution is known, but the work has not been done.

    Type

    No type

    Projects

    Status
    Done

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions